KCNA Service Mesh 3 — Questions and Answers
Question 1: What is mutual TLS (mTLS) in the context of a service mesh?
- One-way TLS where only the server is authenticated
- Both client and server authenticate each other using certificates (Correct answer)
- TLS termination at the ingress gateway only
- Encryption of etcd data at rest
Correct answer: Both client and server authenticate each other using certificates
Mutual TLS requires both the client and server to present certificates, ensuring bidirectional identity verification.
Question 2: Which Istio control plane component was historically responsible for certificate issuance and rotation?
- Pilot
- Mixer
- Citadel (Correct answer)
- Galley
Correct answer: Citadel
Citadel was the Istio component that managed service identity and certificate lifecycle, though its functions are now merged into istiod.
Question 3: What does 'PERMISSIVE' mode mean for Istio's peer authentication policy?
- All traffic must use mTLS
- Both plaintext and mTLS traffic are accepted (Correct answer)
- mTLS is disabled entirely
- Only internal traffic is encrypted
Correct answer: Both plaintext and mTLS traffic are accepted
PERMISSIVE mode allows a service to accept both mTLS-encrypted and plaintext connections, useful during migration to strict mTLS.
Question 4: Which open-source service mesh uses a per-node proxy model instead of per-pod sidecars?
- Istio
- Linkerd
- Cilium Service Mesh (Correct answer)
- Consul Connect
Correct answer: Cilium Service Mesh
Cilium Service Mesh uses eBPF-based per-node proxying rather than injecting a sidecar container into every pod.
Question 5: In Linkerd, what is the control plane component called that provides the CLI and dashboard?
- linkerd-proxy
- linkerd-controller
- linkerd-viz (Correct answer)
- linkerd-inject
Correct answer: linkerd-viz
Linkerd-viz is the extension that provides the web dashboard, metrics, and Tap features for observing traffic.
Question 6: What Kubernetes annotation is typically used to enable automatic sidecar injection in Istio?
- istio.io/inject: 'true'
- sidecar.istio.io/inject: 'true' (Correct answer)
- istio.io/sidecar: 'enabled'
- mesh.istio.io/proxy: 'inject'
Correct answer: sidecar.istio.io/inject: 'true'
The annotation 'sidecar.istio.io/inject: true' on a pod or namespace enables automatic Envoy sidecar injection.
Question 7: Which metric type in a service mesh represents the number of requests per second passing through the mesh?
- Error rate
- Throughput (RPS) (Correct answer)
- Latency percentile
- Connection pool saturation
Correct answer: Throughput (RPS)
Throughput measured in requests per second (RPS) indicates how much traffic the mesh is processing.
KCNA Service Mesh 3
What is mutual TLS (mTLS) in the context of a service mesh?