# Where do you create an Istio PeerAuthentication policy that applies to the whole mesh?

Istio, Easy (Beginner), Security. https://k8wiz.com/uquiz/where-do-you-create-an-istio-peerauthentication-policy-that-applies-to-the-whole-mesh

- A. In the default namespace, with an empty selector
- B. In any namespace, with the label istio.io/mesh-wide
- C. In kube-system, next to the cluster DNS service
- D. In the root namespace, istio-system by default, with no selector

**Answer:** In the root namespace, istio-system by default, with no selector

**Explanation:** A PeerAuthentication in Istio's root namespace without a selector is the mesh-wide policy. A policy without a selector in any other namespace covers only that namespace. Narrower policies win, so namespace and workload policies can still make exceptions to the mesh default.