# A workload has AuthorizationPolicies with CUSTOM, DENY, and ALLOW actions. In what order does Istio check them?

Istio, Hard (Expert), Security. https://k8wiz.com/uquiz/a-workload-has-authorizationpolicies-with-custom-deny-and-allow-actions-in-what-order-does-istio-check-them

- A. CUSTOM, then DENY, then ALLOW
- B. ALLOW, then DENY, then CUSTOM
- C. In the order the policies were created
- D. DENY first, then CUSTOM, then ALLOW

**Answer:** CUSTOM, then DENY, then ALLOW

**Explanation:** Istio checks the layers in order CUSTOM, DENY, ALLOW, and a request that matches a denying policy in an earlier layer stops there. If no ALLOW policy applies to the workload, the request is allowed. If any ALLOW policy applies, at least one must match or the request is denied. That last rule is why adding a single ALLOW policy can block traffic it doesn't mention.