Quick Answer
The correct combination is AWS App Mesh, AWS Cloud Map, and AWS Certificate Manager (ACM). App Mesh provides a service mesh that handles mTLS encryption and authentication between microservices running on ECS Fargate, while Cloud Map enables dynamic service discovery by allowing each service instance to register and be located via DNS or API calls. ACM supplies and manages the X.509 certificates that App Mesh uses to enforce mutual TLS, ensuring that only authenticated services can communicate. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this scenario tests your understanding of how to secure east-west traffic in a microservices architecture without relying on a traditional load balancer. A common trap is to select AWS PrivateLink or a Network Load Balancer for service discovery, but those are for external access, not internal service-to-service lookup. Remember the mnemonic "ACC" for App Mesh, Cloud Map, and Certificate Manager—think of it as the three keys to unlocking secure, discoverable Fargate services.
This SAP-C02 practice question tests your understanding of design for new solutions. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company is deploying a microservices architecture on Amazon ECS with Fargate. They need to enable service-to-service communication with mutual TLS (mTLS) and service discovery. Which combination of services should they use? (Select THREE.)
AWS Certificate Manager (ACM)
ACM provides certificates for mTLS.
Amazon Route 53
Why wrong: Route 53 is for DNS, not service discovery in mesh.
AWS Direct Connect
Why wrong: Direct Connect is for hybrid connectivity.
AWS App Mesh
App Mesh enables mTLS and traffic control.
AWS Cloud Map
Cloud Map provides service discovery.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
AWS Certificate Manager (ACM)
AWS App Mesh provides a service mesh that supports mTLS for encrypting and authenticating service-to-service communication within an ECS Fargate environment. AWS Cloud Map enables service discovery by allowing microservices to register and discover each other via DNS or API calls. AWS Certificate Manager (ACM) is used to provision and manage the X.509 certificates required for mTLS, which are integrated with App Mesh to enforce mutual authentication.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
AWS Certificate Manager (ACM)
Why this is correct
ACM provides certificates for mTLS.
Related concept
Read the scenario before looking for a memorised answer.
Amazon Route 53
Why it's wrong here
Route 53 is for DNS, not service discovery in mesh.
AWS Direct Connect
Why it's wrong here
Direct Connect is for hybrid connectivity.
AWS App Mesh
Why this is correct
App Mesh enables mTLS and traffic control.
Related concept
Read the scenario before looking for a memorised answer.
AWS Cloud Map
Why this is correct
Cloud Map provides service discovery.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
The trap here is that candidates often confuse Amazon Route 53's public DNS capabilities with the internal service discovery provided by AWS Cloud Map, or they assume Direct Connect is needed for secure communication, overlooking that mTLS is handled at the application layer by App Mesh and ACM.
Detailed technical explanation
Under the hood, App Mesh uses Envoy sidecar proxies injected into each ECS task to intercept traffic and enforce mTLS using certificates from ACM, which are distributed via AWS Secrets Manager or ACM Private CA. Cloud Map supports both DNS-based and API-based service discovery, with health checks that automatically deregister unhealthy instances, ensuring traffic only reaches healthy endpoints. A real-world scenario is a multi-service payment platform where each service must authenticate the caller's certificate before processing transactions, preventing unauthorized access even within the VPC.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Design for New Solutions — study guide chapter
Learn the concepts, then practise the questions
Design for New Solutions practice questions
Targeted practice on this topic area only
All SAP-C02 questions
1,746 questions across all exam domains
AWS Certified Solutions Architect Professional SAP-C02 study guide
Full concept coverage aligned to exam objectives
SAP-C02 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise SAP-C02 questions linked to Design Solutions for Organizational Complexity.
Practise SAP-C02 questions linked to Design for New Solutions.
Practise SAP-C02 questions linked to Continuous Improvement for Existing Solutions.
Practise SAP-C02 questions linked to Accelerate Workload Migration and Modernization.
Practise SAP-C02 questions linked to SAA-C03 VPC.
Practise SAP-C02 questions linked to SAA-C03 S3 lifecycle policy questions.
Practise SAP-C02 questions linked to SAA-C03 RDS Multi-AZ questions.
Practise SAP-C02 questions linked to SAA-C03 IAM policy.
Practise SAP-C02 questions linked to SAA-C03 Route 53 failover questions.
Practise SAP-C02 questions linked to SAA-C03 CloudFront.
Practise SAP-C02 questions linked to SAA-C03 NAT gateway questions.
Practise SAP-C02 questions linked to SAA-C03 VPC endpoint questions.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Design for New Solutions — This question tests Design for New Solutions — Read the scenario before looking for a memorised answer..
The correct answer is: AWS Certificate Manager (ACM) — AWS App Mesh provides a service mesh that supports mTLS for encrypting and authenticating service-to-service communication within an ECS Fargate environment. AWS Cloud Map enables service discovery by allowing microservices to register and discover each other via DNS or API calls. AWS Certificate Manager (ACM) is used to provision and manage the X.509 certificates required for mTLS, which are integrated with App Mesh to enforce mutual authentication.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a containerized microservices architecture on Amazon ECS. The services must be able to discover each other using DNS names. Which AWS service should the company use for service discovery?
mediumWhy A: AWS Cloud Map is the correct choice because it provides a fully managed service discovery solution that integrates natively with Amazon ECS. It allows microservices to register their DNS names and health checks, enabling other services to discover them via DNS queries or API calls. This directly supports the requirement for containerized services to find each other using DNS names within an ECS cluster.
Variation 2. A company is designing a new microservices architecture on Amazon ECS with Fargate. The services need to communicate with each other securely. The company wants to use service discovery so that services can find each other using DNS names. Which AWS service should the company use?
mediumWhy C: Option C is correct because AWS Cloud Map provides service discovery for ECS services, allowing them to register and discover each other via DNS or API calls. Option A is wrong because Route 53 private hosted zones can be used but Cloud Map is specifically designed for service discovery. Option B is wrong because ELB is for load balancing, not service discovery. Option D is wrong because VPC endpoints are for accessing AWS services privately, not for service discovery.
Variation 3. A company is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. The company wants to implement service discovery and load balancing at the application layer. Which TWO services should the company use?
mediumWhy C: AWS Cloud Map provides service discovery, and Application Load Balancer provides application-layer load balancing. Option B (NLB) is layer 4. Option C (Route 53) is for DNS. Option D (API Gateway) is for API management.
Variation 4. A company is designing a new microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which THREE mechanisms can be used for service-to-service communication? (Choose THREE.)
mediumWhy B: Options A, B, and C are correct because service discovery, ALB, and API Gateway are common patterns for service communication. Option D is incorrect because SQS is for asynchronous messaging, not direct communication. Option E is incorrect because DynamoDB is a database, not a communication mechanism.
Variation 5. A company is designing a new microservices architecture using Amazon ECS with the Fargate launch type. The services need to communicate securely within a VPC. The company requires that inter-service communication is encrypted and that the services can discover each other using DNS names. Which THREE steps should the company take to meet these requirements?
hardWhy C: Option A is correct because Service Discovery enables DNS-based service discovery. Option B is correct because ECS tasks can use service discovery names via DNS. Option D is correct because VPC endpoints for ECR and other services are needed for Fargate to pull images. Option C is wrong because VPC Peering is not needed; services are in the same VPC. Option E is wrong because an Application Load Balancer is not required for inter-service communication; service discovery and direct communication suffice.
Last reviewed: Jun 11, 2026
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.