Practice vocabulary for service mesh security: mTLS enforcement, authorization policies, certificate rotation, SPIFFE/SPIRE workload identity, and zero-trust networking.
0 / 10 completed
1 / 10
When an Istio PeerAuthentication policy requires all service-to-service communication to use mutual TLS with no plaintext fallback, it is described as:
The PeerAuthentication enforces mTLS in STRICT mode — STRICT means plaintext connections are rejected; PERMISSIVE allows both (used during migration).
2 / 10
When a mesh policy controls which services are permitted to call a specific service, this policy is called:
The AuthorizationPolicy allows only service A to call service B — Istio AuthorizationPolicy grants access at L7, going beyond IP-based network policies.
3 / 10
When workload certificates are automatically replaced on a regular schedule to limit exposure if a certificate is compromised, this is called:
The certificate is rotated every 24 hours — short-lived certificates reduce the window of exposure if a private key is ever compromised.
4 / 10
The framework used by Istio to issue cryptographic workload identities based on the SPIFFE standard is called:
The mesh issues workload certificates via SPIFFE/SPIRE — SPIFFE defines the identity standard; SPIRE is the implementation that issues SVIDs (workload certificates).
5 / 10
The security model where no service trusts another by default and all communication must be authenticated — even inside the cluster — is called:
The zero-trust network inside the mesh — service mesh enables zero-trust by providing mTLS and AuthorizationPolicies for every service-to-service call.
6 / 10
During a code review of the new service mesh configuration for Project Phoenix, Sarah notes that the team is using 'Mutual TLS with Zero Trust' to secure inter-service communication. David asks: 'Can you elaborate on what 'Zero Trust' specifically means in this context?'. Which statement best describes the intended meaning?
Zero Trust in this context signifies that no service automatically trusts another. Instead, every communication, even within the cluster, must be authenticated and authorized based on defined policies. This contrasts with traditional perimeter-based security where trust is implicitly granted to services inside the network.
7 / 10
You're drafting a pull request description for adding a new policy that restricts access to the payment-service from all other services except fraud-detection-service. Mark asks: 'How do we formally define this kind of granular service authorization within Istio?' Which term most accurately describes this mechanism?
A Service Mesh Policy is the correct terminology for defining rules that control which services are permitted to call other services within a service mesh. PeerAuthentication focuses on mutual TLS, Traffic Shadowing allows observing traffic without impacting it, and Admission Controllers handle more general policy enforcement at the gateway level.
8 / 10
During a daily standup meeting with the DevOps team, Alex mentions that they are employing 'Automatic Certificate Rotation' for their workload certificates. He explains that this is done to mitigate the risk of compromised certificates. What is the primary benefit of this approach?
The main advantage of Automatic Certificate Rotation lies in minimizing the potential damage from compromised certificates. Regularly rotating certificates reduces the time an attacker has to exploit a stolen key, significantly limiting the scope of a security breach. It doesn't affect service versions or CA trust.
9 / 10
You've been tasked with understanding how Istio implements SPIFFE (Secure Production Identity Framework for Everyone). You discover that it utilizes a distributed identity system based on cryptographic workload identities. Which of the following best describes this core functionality?
The core principle of SPIFFE is decentralized identity management. Each workload receives a unique cryptographic identity, allowing services to verify each other's authenticity without relying on a central authority. This distributed trust model enhances security and simplifies service onboarding.
10 / 10
In a Slack message during an incident investigation, a developer explains that the team is operating under a 'Default Deny' security model within their service mesh. What does this mean?
A 'Default Deny' security model is characterized by requiring explicit authorization for every communication. This contrasts with a 'Default Allow' model where traffic is unrestricted until explicitly blocked. This approach drastically reduces the attack surface and enforces granular control over service interactions.
What will I learn from the "Service Mesh Security Vocabulary" exercise?
Practice vocabulary for service mesh security: mTLS enforcement, authorization policies, certificate rotation, SPIFFE/SPIRE workload identity, and zero-trust networking.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.
How many questions are in this exercise?
This set contains 10 multiple-choice questions, each with a detailed explanation shown after you answer.
Do I need to create an account to track my progress?
No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.
Who is this Service Mesh Operations Language exercise for?
This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss service mesh operations language topics confidently at work.
What happens if I answer a question incorrectly?
You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.
Can I retry this exercise?
Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.
How long does this exercise take to complete?
Most learners finish all 10 questions in under 10 minutes, since each question is answered by clicking a single option.
Where can I find more Service Mesh Operations Language exercises?
See the full Service Mesh Operations Language exercises hub for more vocabulary drills on this topic.
Is this exercise mobile-friendly?
Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.