# In Istio ambient mode, which component handles mTLS and L4 policy for the pods on each node?

Istio, Hard (Expert), Architecture. https://k8wiz.com/uquiz/in-istio-ambient-mode-which-component-handles-mtls-and-l4-policy-for-the-pods-on-each-node

- A. An Envoy sidecar in every pod
- B. A waypoint proxy in every namespace
- C. ztunnel, a per-node proxy
- D. istiod, which proxies all traffic

**Answer:** ztunnel, a per-node proxy

**Explanation:** Ambient mode removes sidecars. ztunnel runs as a DaemonSet, carries pod traffic in mTLS over HBONE tunnels and enforces L4 authorization. L7 features need a waypoint proxy, which you deploy only where you need it.