CLF-C02 Cloud Technology and Services Practice Question
A company is adopting microservices and wants to enable their services to communicate securely and track network traffic between them. Which AWS service provides service mesh capabilities with mutual TLS and observability?
⚠ Common exam trap
A common mix-up: candidates confuse network-level services like VPC security groups or Transit Gateway with application-level service mesh capabilities, overlooking that mTLS and observability require a dedicated service mesh like AWS App Mesh.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS App Mesh
AWS App Mesh is a service mesh that provides application-level networking, enabling microservices to communicate securely with mutual TLS (mTLS) and offering observability through metrics, logs, and traces. It integrates with AWS services like AWS X-Ray and Amazon CloudWatch to track network traffic between services, making it the correct choice for this requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon VPC with security groups
Why it's wrong here
Amazon VPC security groups are stateful, instance-level firewalls that filter traffic by IP address, port, and protocol. Although they secure communication at the network layer, they cannot implement Layer 7 service mesh capabilities such as mutual TLS, weighted traffic routing, retries, or distributed tracing between microservices. Security groups therefore control who can connect to a resource, but they provide no visibility or management of individual service-to-service requests.
- ✓
AWS App Mesh
Why this is correct
AWS App Mesh is a managed service mesh that uses Envoy sidecar proxies to control and observe microservice-to-microservice traffic. It provides mutual TLS encryption between services, fine-grained traffic routing with retries and timeouts, and integrates with AWS X-Ray and Amazon CloudWatch for metrics and traces. This makes App Mesh the correct choice when the requirement is application-level traffic management, identity-based security, and observability across services, rather than simple network connectivity.
- ✗
Amazon API Gateway
Why it's wrong here
Amazon API Gateway is a fully managed service for creating REST, WebSocket, and HTTP APIs that expose backend functions to external clients. It focuses on request authentication, API throttling, caching, and request/response transformation at an edge endpoint, not on intercepting internal microservice traffic. As the front door of an application, API Gateway cannot perform service mesh functions such as sidecar-based mutual TLS or per-service traffic splitting within a private service-to-service network.
- ✗
AWS Transit Gateway
Why it's wrong here
AWS Transit Gateway acts as a regional transit hub that routes traffic between numerous VPCs and on-premises networks using route tables and attachments. It optimizes network topology at Layers 3 and 4, moving packets efficiently, but it does not understand individual application services or their protocols. Without awareness of service identity, HTTP paths, or application traffic patterns, Transit Gateway cannot provide the mutual TLS, observability, and traffic-shaping features expected from a service mesh.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 993 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.