1. Layer 7 – This is the network layer that the service mesh works on.
2. All of the above.
3. False – The Istio control plane is not a single point of failure since applications can continue to run without a control plane,
4. True – A true service mesh is formed through a data plane where there's an Envoy sidecar proxy next to each microservice, which helps achieve service mesh functions. 
5. False – Istio can span multiple Kubernetes clusters through a replicated control plane, a shared control plane using a single network and a shared control plane using a multi-network.
6. True – At the time of writing, Istio service discovery integration with Consul is in its alpha phase.
7. False – This should be the other way around. Pilot pushes configuration to Envoy, which manages traffic.
8. False – Istio primitives are Custom Resource Definitions (CRD) and can be managed by kubectl, as well as istioctl.
9. True – Istio's mTLS implementation comes as a self-service model since it is out of the box and controlled through a parameter.
10. True – Kiali (originally developed at RedHat) is used to observe the service mesh for connectivity and traffic patterns.