DVA-C02 Deployment Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use AWS Cloud Map for service discovery and AWS App Mesh with mutual TLS

  Why this is correct

  AWS Cloud Map provides robust service discovery, allowing microservices to dynamically locate each other using either DNS queries or an API. When combined with AWS App Mesh, a service mesh solution, it enables advanced traffic management and security features. App Mesh facilitates mutual TLS (mTLS) between services by injecting Envoy proxies, ensuring that both the client and server services authenticate each other with certificates, thus securing inter-service communication at the transport layer without requiring application code changes. This combination is the most suitable for secure, dynamic microservice interactions.

• ✗

  Use Amazon API Gateway and AWS Lambda

  Why it's wrong here

  Amazon API Gateway is designed to act as a "front door" for applications, exposing external HTTP/S endpoints to clients, not for internal service-to-service communication. AWS Lambda provides serverless compute for executing functions. While Lambda functions can be invoked internally, routing all inter-service communication through API Gateway introduces unnecessary latency, increased costs, and architectural complexity compared to direct service-to-service communication patterns. It is not optimized for the high-volume, low-latency, and secure internal communication typically required in a microservices environment.

• ✗

  Use Amazon Route 53 private hosted zones and enable DNSSEC

  Why it's wrong here

  Amazon Route 53 private hosted zones can provide internal DNS resolution for microservices, assisting with basic service discovery within a VPC. However, enabling DNSSEC (DNS Security Extensions) only authenticates DNS responses, protecting against DNS spoofing and cache poisoning. DNSSEC does not encrypt the actual data traffic flowing between services or provide mutual authentication at the transport layer. Therefore, it fails to meet the crucial requirement for mutual TLS, which secures the communication channel itself by verifying both client and server identities.

• ✗

  Use an Application Load Balancer for each service and enable TLS termination

  Why it's wrong here

  Application Load Balancers (ALBs) are primarily designed for distributing external client traffic across multiple targets and can terminate TLS connections from clients. Deploying an ALB for each internal microservice for inter-service communication is an inefficient and overly complex architectural pattern. This approach introduces significant operational overhead and cost, as each ALB requires management and incurs charges. Furthermore, while ALBs handle client-to-load balancer TLS, they do not inherently provide mutual TLS for authenticating and encrypting the service-to-service communication beyond the load balancer itself.

Go deeper

Related to this question