Question bank
Istio Certified Associate
40 Istio Certified Associate questions with the correct answer and a written explanation, organised across 5 exam domains.
- 40 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Advanced Istio Features
6 questions in this domain
- Question 1Single Choice
Which Istio resource is primarily used to define mTLS settings at a global, namespace, or workload level?
- APeerAuthenticationCorrect answer
- BRequestAuthentication
- CAuthorizationPolicy
- DServiceEntry
Why this is the answer
PeerAuthentication is the Istio resource for defining mTLS settings. It dictates whether a workload accepts plaintext or requires STRICT, PERMISSIVE, or DISABLE modes.
- Question 2Multiple Select
Which modes are part of PeerAuthentication in Istio? Select all that apply.
- ASTRICTCorrect answer
- BPERMISSIVECorrect answer
- CDISABLECorrect answer
- DALLOW
Why this is the answer
PeerAuthentication supports STRICT, PERMISSIVE, and DISABLE modes. ALLOW is not a valid mTLS mode in Istio.
- Question 3Interactive
Inspect the provided YAML. What effect will this PeerAuthentication policy have on workloads in the configured namespace?
- AWorkloads accept both mTLS and plaintext traffic.Correct answer
- BWorkloads only accept mTLS traffic.
- CWorkloads only accept plaintext traffic.
- DWorkloads reject all incoming traffic.
Why this is the answer
PERMISSIVE mode allows both mTLS and plaintext traffic, making it a transitional state during migrations rather than a security enforcement mode.
- Question 4Single Choice
Which PeerAuthentication mode provides the highest security posture by rejecting all plaintext traffic?
- ASTRICTCorrect answer
- BPERMISSIVE
- CDISABLE
- DALLOW
Why this is the answer
STRICT mode is the highest security posture because workloads only accept encrypted mTLS traffic and any plaintext request is immediately rejected.
- Question 5Multiple Select
How does Istio encode service identities for mTLS certificates? Select the two correct elements.
- ASPIFFE standardCorrect answer
- BSAN fieldCorrect answer
- CJWT claim
- DJWKS endpoint
Why this is the answer
Istio uses the SPIFFE standard to encode service identities into the SAN field of X.509 certificates, enabling granular policy enforcement.
- Question 6Interactive
Based on the provided YAML, which workloads are affected by this PeerAuthentication policy?
- AOnly workloads with the label app=payments in namespace fooCorrect answer
- BAll workloads in namespace foo
- CAll workloads in the mesh
- DOnly workloads in the namespace bar
Why this is the answer
The selector targets workloads matching the label app=payments in namespace foo. Workload-level policies are more specific than namespace or mesh policies.
Istio Fundamentals
10 questions in this domain
- Question 7Single Choice
What is the primary purpose of a PeerAuthentication resource in Istio?
- ADefine mTLS settings at different mesh levelsCorrect answer
- BValidate JSON Web Tokens for user identity
- CDefine routing rules between services
- DControl which users can perform actions
Why this is the answer
PeerAuthentication is the Istio resource used to define mTLS settings, not JWT validation, routing, or authorization.
- Question 8Multiple Select
Which of the following are valid mTLS modes in a PeerAuthentication resource? (Select all that apply.)
- ASTRICTCorrect answer
- BPERMISSIVECorrect answer
- CDISABLECorrect answer
- DALLOW
Why this is the answer
PeerAuthentication supports STRICT, PERMISSIVE, and DISABLE modes. ALLOW is not a PeerAuthentication mode.
- Question 9Interactive
What mTLS mode is enforced by the PeerAuthentication resource shown in the code block?
- ASTRICTCorrect answer
- BPERMISSIVE
- CDISABLE
- DALLOW
Why this is the answer
The YAML sets mtls.mode to STRICT, so only encrypted mTLS traffic is accepted.
- Question 10Single Choice
What does the SPIFFE standard encode into the SAN field of X.509 certificates in Istio?
- AWorkload service identitiesCorrect answer
- BUser email addresses
- CJWT signing keys
- DMesh configuration versions
Why this is the answer
Istio uses SPIFFE to encode service identities into the SAN field of X.509 certificates for granular policy enforcement.
- Question 11Multiple Select
Which statements about Istio automatic certificate management are correct? (Select all that apply.)
- Aistiod automatically generates and distributes certificatesCorrect answer
- BCertificates are distributed through Secret Discovery Service (SDS)Correct answer
- CCertificates are rotated frequently to limit compromise impactCorrect answer
- DOperators must manually renew each workload certificate
Why this is the answer
istiod automates certificate generation, SDS distribution, and frequent rotation. Manual renewal is not required.
- Question 12Interactive
If the PeerAuthentication resource in the code block contains no selector, which workloads are affected?
- AAll workloads in the namespace where the resource is definedCorrect answer
- BOnly workloads with a specific label
- CAll workloads in the entire mesh
- DOnly workloads outside the mesh
Why this is the answer
When no selector is provided, the PeerAuthentication policy applies to all workloads in the specified namespace.
- Question 13Single Choice
What is PERMISSIVE mode designed to do during a mesh migration?
- AAllow both mTLS and plaintext traffic to avoid downtimeCorrect answer
- BProvide the highest security by rejecting plaintext traffic
- CDisable all encryption and authentication
- DAutomatically rewrite plaintext requests to mTLS
Why this is the answer
PERMISSIVE is a transitional state that accepts both mTLS and plaintext traffic, enabling safe migration.
- Question 14Multiple Select
Which statements correctly describe Istio policy precedence? (Select all that apply.)
- AWorkload-level policies override namespace-level policiesCorrect answer
- BNamespace-level policies override mesh-wide policiesCorrect answer
- CThe broadest scope always has the highest precedence
- DThe most specific selector always takes precedenceCorrect answer
Why this is the answer
Precedence from highest to lowest is workload, namespace, then mesh. The most specific selector wins.
- Question 15Interactive
The Istio resource in the code block is responsible for validating what?
- AJWT user identityCorrect answer
- BmTLS workload identity
- CNetwork routing rules
- DAuthorization permissions
Why this is the answer
This is a RequestAuthentication resource, which validates JWT user identity, not mTLS workload identity.
- Question 16Single Choice
What is the role of an Ingress Gateway in Istio?
- ADedicated entry point for external traffic entering the meshCorrect answer
- BManages outbound traffic leaving the mesh
- CStores workload certificates
- DDefines routing rules between services
Why this is the answer
The Ingress Gateway is the entry point for external traffic and handles edge responsibilities such as TLS termination.
Observability
8 questions in this domain
- Question 17Single Choice
Which Istio resource is the primary mechanism for defining mTLS settings at the mesh, namespace, or workload level?
- APeerAuthenticationCorrect answer
- BRequestAuthentication
- CAuthorizationPolicy
- DServiceEntry
Why this is the answer
PeerAuthentication is the Istio resource that defines mTLS behavior and can be applied globally, per namespace, or per workload.
- Question 18Multiple Select
Which statements accurately describe PERMISSIVE mode in Istio PeerAuthentication?
- AIt accepts both mTLS and plaintext traffic.Correct answer
- BIt is primarily a migration tool, not a long-term security posture.Correct answer
- CIt provides stronger security than STRICT mode.
- DIt allows non-mesh clients to reach mesh services without encryption.Correct answer
Why this is the answer
PERMISSIVE is a transitional state that accepts both mTLS and plaintext traffic. It is not a security enforcement mode and is less restrictive than STRICT.
- Question 19Interactive
Review the YAML. What is the scope of this PeerAuthentication policy?
- AAll workloads in the foo namespaceCorrect answer
- BAll workloads in the entire mesh
- COnly workloads labeled app: legacy
- DOnly workloads in the default namespace
Why this is the answer
With no selector, the PeerAuthentication policy applies to all workloads in the namespace where it is created, here namespace foo.
- Question 20Single Choice
Which of the following shows the correct policy precedence in Istio, from highest to lowest?
- AWorkload > Namespace > MeshCorrect answer
- BMesh > Namespace > Workload
- CNamespace > Workload > Mesh
- DMesh > Workload > Namespace
Why this is the answer
Istio applies the most specific policy first. Workload-level policies override namespace-level policies, and namespace-level policies override mesh-wide policies.
- Question 21Multiple Select
Which modes are valid for Istio PeerAuthentication mTLS enforcement?
- ASTRICTCorrect answer
- BPERMISSIVECorrect answer
- CDISABLECorrect answer
- DENABLE
Why this is the answer
The valid PeerAuthentication modes are STRICT, PERMISSIVE, and DISABLE. There is no ENABLE mode in Istio.
- Question 22Interactive
Refer to the YAML. What does this Istio resource validate?
- AJWT tokens for the payments serviceCorrect answer
- BmTLS certificates for the payments service
- CAuthorization rules for the api namespace
- DService entries for external destinations
Why this is the answer
RequestAuthentication validates JWT identity for the selected workload. It does not manage mTLS, authorization, or service entries.
- Question 23Single Choice
Which standard does Istio use to encode service identities into X.509 certificates?
- ASPIFFECorrect answer
- BOAuth 2.0
- CSAML
- DKerberos
Why this is the answer
Istio uses SPIFFE identities in the Subject Alternative Name field of X.509 certificates to identify workloads.
- Question 24Multiple Select
Which Istio components provide centralized entry and exit points for external traffic?
- AIngress GatewayCorrect answer
- BEgress GatewayCorrect answer
- CVirtualService
- DServiceEntry
Why this is the answer
Ingress Gateway handles incoming external traffic, while Egress Gateway handles outgoing external traffic. VirtualService and ServiceEntry are not gateways.
Security
8 questions in this domain
- Question 25Single Choice
Which PeerAuthentication mode rejects every plaintext request and only accepts traffic encrypted with mTLS?
- ASTRICTCorrect answer
- BPERMISSIVE
- CDISABLE
- DALLOW
Why this is the answer
STRICT is the highest-security mTLS mode. It only accepts encrypted mTLS traffic and rejects plaintext requests, making it the standard for Zero Trust environments.
- Question 26Multiple Select
Which statements accurately describe PERMISSIVE mode in Istio PeerAuthentication? (Select all that apply.)
- AIt accepts both mTLS and plaintext traffic.Correct answer
- BIt is designed as a transitional migration state to maintain availability.Correct answer
- CIt guarantees the same protection as STRICT mode.
- DIt only allows unencrypted traffic.
Why this is the answer
PERMISSIVE is a migration-oriented mode that accepts both mTLS and plaintext. It is not a security enforcement tool and should not be confused with STRICT.
- Question 27Interactive
Review the PeerAuthentication YAML in the code block. What happens to incoming requests on the workload that matches the selector?
- AOnly encrypted mTLS requests are accepted; plaintext requests are rejected.Correct answer
- BBoth plaintext and mTLS requests are accepted.
- CPlaintext requests are accepted, but mTLS is disabled.
- DJWT tokens are validated before any request is allowed.
Why this is the answer
The YAML applies STRICT mode to the selected workload. STRICT rejects plaintext and requires mutual TLS, so only encrypted mTLS requests are accepted.
- Question 28Single Choice
In Istio, which resource acts as the 'door' that defines the ports and hosts for inbound traffic, while routing decisions are left to VirtualService?
- AGatewayCorrect answer
- BServiceEntry
- CPeerAuthentication
- DDestinationRule
Why this is the answer
Gateway defines the entry point, or 'door,' by specifying ports and hosts. VirtualService then determines routing, the 'hallway.'
- Question 29Multiple Select
Which options correctly differentiate PeerAuthentication from RequestAuthentication? (Select all that apply.)
- APeerAuthentication uses mTLS to secure the transport channel and workload identity.Correct answer
- BRequestAuthentication validates JWT tokens to authenticate end users.Correct answer
- CRequestAuthentication provides mTLS-level service identity.
- DPeerAuthentication is interchangeable with AuthorizationPolicy.
Why this is the answer
PeerAuthentication is transport-layer mTLS for workload identity. RequestAuthentication validates JWT tokens for user identity. They are not interchangeable with authorization.
- Question 30Interactive
Examine the Gateway and VirtualService YAML in the code block. A request arrives at the mesh edge on the HTTPS port for the configured external host. Which resource directs it to the corresponding internal service?
- AVirtualServiceCorrect answer
- BGateway
- CServiceEntry
- DPeerAuthentication
Why this is the answer
The Gateway exposes the port and host at the edge, while the VirtualService maps that host to the internal service destination, acting as the routing rule.
- Question 31Single Choice
Which Istio control plane component automates certificate generation, distribution via SDS, and rotation for mTLS?
- AistiodCorrect answer
- BIngress Gateway
- CEgress Gateway
- DKubernetes API server
Why this is the answer
istiod automates certificate generation, SDS distribution, and rotation. This minimizes the blast radius of any potential key compromise.
- Question 32Multiple Select
Which statements about Istio workload identity are correct? (Select all that apply.)
- AIstio encodes service identities in the SAN field of X.509 certificates.Correct answer
- BIstio uses the SPIFFE standard to identify workloads.Correct answer
- CSPIFFE identities are embedded in JWT claims for mTLS authentication.
- DService identity is assigned only to human users, not workloads.
Why this is the answer
Istio follows the SPIFFE standard and puts service identity into the SAN of X.509 certificates, enabling granular workload-based policies.
Traffic Management
8 questions in this domain
- Question 33Single Choice
Which Istio resource is used to define mTLS settings at the mesh, namespace, or workload level?
- APeerAuthenticationCorrect answer
- BRequestAuthentication
- CAuthorizationPolicy
- DServiceEntry
Why this is the answer
PeerAuthentication is the primary Istio resource for mTLS settings at the mesh, namespace, or workload level.
- Question 34Multiple Select
Which statements accurately describe PERMISSIVE mode? Select all that apply.
- AIt accepts both mTLS and plaintext trafficCorrect answer
- BIt is a migration tool, not a security enforcement toolCorrect answer
- CIt rejects all plaintext requests
- DIt is the most secure mTLS posture
Why this is the answer
PERMISSIVE accepts mTLS and plaintext and is primarily a migration tool, not a security enforcement mode.
- Question 35Interactive
Based on the provided PeerAuthentication YAML, what will the sidecar proxy do with plaintext requests?
- AReject all plaintext trafficCorrect answer
- BAccept plaintext and mTLS traffic
- CDisable TLS completely
- DRequire a valid JWT token
Why this is the answer
STRICT mode rejects plaintext requests, accepting only encrypted mTLS traffic.
- Question 36Single Choice
Which order correctly represents PeerAuthentication policy precedence in Istio?
- AWorkload > Namespace > MeshCorrect answer
- BMesh > Namespace > Workload
- CNamespace > Workload > Mesh
- DMesh > Workload > Namespace
Why this is the answer
Istio applies PeerAuthentication policies from broadest to most specific: workload-level policy takes precedence over namespace and mesh.
- Question 37Multiple Select
Which of the following are traps or misconceptions described in the playbook? Select all that apply.
- AConfusing mTLS with JWT validationCorrect answer
- BThinking PERMISSIVE is more secure than STRICTCorrect answer
- CUsing STRICT mode as a migration tool
- DConfusing mTLS with AuthorizationCorrect answer
Why this is the answer
The playbook lists confusing mTLS with JWT, treating PERMISSIVE as more secure, and confusing mTLS with authorization as traps.
- Question 38Interactive
Given the provided PeerAuthentication policies, what is the effective mode for the workload selected by the second resource?
- APlaintext traffic is acceptedCorrect answer
- BOnly mTLS traffic is accepted
- CAll traffic is rejected
- DTLS is terminated at the gateway
Why this is the answer
Workload-level DISABLE overrides the namespace-level STRICT policy, so plaintext traffic is accepted for that workload.
- Question 39Single Choice
What is the primary purpose of an Egress Gateway in Istio?
- AManage and secure outbound trafficCorrect answer
- BAccept all external inbound traffic
- CAutomatically rotate certificates
- DValidate JWTs for users
Why this is the answer
An Egress Gateway manages and secures outbound traffic leaving the mesh, providing centralized control and monitoring.
- Question 40Multiple Select
Which statements correctly differentiate authentication and authorization in Istio? Select all that apply.
- ARequestAuthentication validates JWT tokensCorrect answer
- BAuthorizationPolicy defines who can do whatCorrect answer
- CPeerAuthentication is used for JWT validation
- DmTLS and Authorization are interchangeable
Why this is the answer
RequestAuthentication handles JWT validation, while AuthorizationPolicy enforces permissions. mTLS and authorization are separate layers.
Frequently asked questions
Everything about the Istio Certified Associate question bank and how to use it.