# You create an Istio PeerAuthentication with a workload selector in the root namespace, istio-system. What does Istio do with it?

Istio, Hard (Expert), Security. https://k8wiz.com/uquiz/you-create-an-istio-peerauthentication-with-a-workload-selector-in-the-root-namespace-istio-system-what-does-istio-do-with-it

- A. It applies the policy to matching workloads in every namespace
- B. It ignores the policy, because root-namespace policies need no selector
- C. It applies the policy only to matching workloads in istio-system
- D. It merges the selector into the mesh-wide default policy

**Answer:** It ignores the policy, because root-namespace policies need no selector

**Explanation:** The PeerAuthentication API states that policies with workload selectors are ignored when deployed in the root namespace. A root-namespace policy is only meaningful as the mesh-wide default without a selector. To target specific workloads, put the policy with its selector in their own namespace.