# Which mutual TLS mode does an Istio sidecar workload accept by default when no PeerAuthentication policy applies to it?

Istio, Easy (Beginner), Security. https://k8wiz.com/uquiz/which-mutual-tls-mode-does-an-istio-sidecar-workload-accept-by-default-when-no-peerauthentication-policy-applies-to-it

- A. STRICT
- B. PERMISSIVE
- C. DISABLE
- D. ISTIO_MUTUAL

**Answer:** PERMISSIVE

**Explanation:** Without a policy, Istio uses PERMISSIVE, so workloads accept both mutual TLS and plain text. Sidecars still send mutual TLS to each other through auto mTLS, but clients without a proxy can connect in plain text. ISTIO_MUTUAL is a DestinationRule TLS mode for clients, not a PeerAuthentication mode.