# A DestinationRule sets trafficPolicy.tls.mode: DISABLE for a host. What happens when that host's Istio PeerAuthentication changes to STRICT?

Istio, Medium (Advanced), Security. https://k8wiz.com/uquiz/a-destinationrule-sets-trafficpolicytlsmode-disable-for-a-host-what-happens-when-that-hosts-istio-peerauthentication-changes-to

- A. Istio ignores the DestinationRule and uses mutual TLS anyway
- B. The API server rejects the new PeerAuthentication policy
- C. Clients send plain text because of the rule, and their requests fail
- D. The host falls back to PERMISSIVE mode for those clients only

**Answer:** Clients send plain text because of the rule, and their requests fail

**Explanation:** Auto mTLS only decides what clients send when nothing overrides it, and a DestinationRule with tls.mode DISABLE explicitly turns mutual TLS off on the client side. A STRICT server then rejects those plain-text connections. Remove the tls block or set ISTIO_MUTUAL before locking the host down.