Service Discovery and mTLS for ECS Fargate Microservices
A company is deploying a microservices architecture on Amazon ECS with Fargate. They need to enable service-to-service communication with mutual TLS (mTLS) and service discovery. Which combination of services should they use? (Select THREE.)
Quick Answer
The correct combination is AWS App Mesh, AWS Cloud Map, and AWS Certificate Manager (ACM). App Mesh provides a service mesh that handles mTLS encryption and authentication between microservices running on ECS Fargate, while Cloud Map enables dynamic service discovery by allowing each service instance to register and be located via DNS or API calls. ACM supplies and manages the X.509 certificates that App Mesh uses to enforce mutual TLS, ensuring that only authenticated services can communicate. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this scenario tests your understanding of how to secure east-west traffic in a microservices architecture without relying on a traditional load balancer. A common trap is to select AWS PrivateLink or a Network Load Balancer for service discovery, but those are for external access, not internal service-to-service lookup. Remember the mnemonic "ACC" for App Mesh, Cloud Map, and Certificate Manager—think of it as the three keys to unlocking secure, discoverable Fargate services.
⚠ Common exam trap
It's easy for candidates to confuse Amazon Route 53's public DNS capabilities with the internal service discovery provided by AWS Cloud Map, or they assume Direct Connect is needed for secure communication, overlooking that mTLS is handled at the application layer by App Mesh and ACM.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Certificate Manager (ACM)
AWS App Mesh provides a service mesh that supports mTLS for encrypting and authenticating service-to-service communication within an ECS Fargate environment. AWS Cloud Map enables service discovery by allowing microservices to register and discover each other via DNS or API calls. AWS Certificate Manager (ACM) is used to provision and manage the X.509 certificates required for mTLS, which are integrated with App Mesh to enforce mutual authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Certificate Manager (ACM)
Why this is correct
ACM provides certificates for mTLS.
- ✗
Amazon Route 53
Why it's wrong here
Route 53 is for DNS, not service discovery in mesh.
- ✗
AWS Direct Connect
Why it's wrong here
Direct Connect is for hybrid connectivity.
- ✓
AWS App Mesh
Why this is correct
App Mesh enables mTLS and traffic control.
- ✓
AWS Cloud Map
Why this is correct
Cloud Map provides service discovery.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a containerized microservices architecture on Amazon ECS. The services must be able to discover each other using DNS names. Which AWS service should the company use for service discovery?
medium- ✓ A.AWS Cloud Map
- B.Amazon Route 53 Resolver
- C.Elastic Load Balancing (ELB)
- D.Amazon Elastic Container Registry (ECR)
Why A: AWS Cloud Map is the correct choice because it provides a fully managed service discovery solution that integrates natively with Amazon ECS. It allows microservices to register their DNS names and health checks, enabling other services to discover them via DNS queries or API calls. This directly supports the requirement for containerized services to find each other using DNS names within an ECS cluster.
Variation 2. A company is designing a new microservices architecture on Amazon ECS with Fargate. The services need to communicate with each other securely. The company wants to use service discovery so that services can find each other using DNS names. Which AWS service should the company use?
medium- A.AWS PrivateLink with VPC endpoint services.
- B.Amazon Route 53 private hosted zones with DNS records for each service.
- ✓ C.AWS Cloud Map with namespaces and service instances.
- D.Elastic Load Balancing with internal load balancers for each service.
Why C: AWS Cloud Map is the correct choice because it is a cloud resource discovery service specifically designed for microservices architectures. It allows you to define custom namespaces (public, private DNS, or API-based) and register service instances with health checks. Services running on ECS with Fargate can then discover each other via DNS queries or API calls, enabling dynamic and secure communication without managing static IPs or load balancers.
Variation 3. A company is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. The company wants to implement service discovery and load balancing at the application layer. Which TWO services should the company use?
medium- A.Amazon API Gateway
- B.Network Load Balancer (NLB)
- ✓ C.AWS Cloud Map
- ✓ D.Application Load Balancer (ALB)
- E.Amazon Route 53
Why C: AWS Cloud Map is correct because it provides service discovery for microservices by allowing services to register their DNS names and health checks, enabling dynamic routing between ECS Fargate tasks. Application Load Balancer (ALB) is correct because it operates at Layer 7 (application layer), supporting HTTP/HTTPS traffic, path-based routing, and integration with ECS for load balancing across Fargate tasks.
Variation 4. A company is designing a new microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which THREE mechanisms can be used for service-to-service communication? (Choose THREE.)
medium- A.Amazon SQS queues between services
- ✓ B.Amazon API Gateway as a front end
- ✓ C.Application Load Balancer (ALB) as a service mesh
- ✓ D.AWS Cloud Map service discovery
- E.Amazon DynamoDB as a communication channel
Why B: Amazon API Gateway acts as a front-end proxy that can route requests to ECS Fargate services, enabling synchronous service-to-service communication via RESTful or WebSocket APIs. It handles authentication, throttling, and request transformation, making it a suitable mechanism for external or internal service calls.
Variation 5. A company is designing a new microservices architecture using Amazon ECS with the Fargate launch type. The services need to communicate securely within a VPC. The company requires that inter-service communication is encrypted and that the services can discover each other using DNS names. Which THREE steps should the company take to meet these requirements?
hard- A.Deploy an Application Load Balancer in front of each service for inter-service communication.
- B.Create a VPC peering connection between the services' subnets.
- ✓ C.Enable AWS Cloud Map for service discovery.
- ✓ D.Configure the ECS task definitions to use the awsvpc network mode.
- ✓ E.Create VPC endpoints for Amazon ECR and Amazon S3 to allow Fargate tasks to pull images.
Why C: AWS Cloud Map is a cloud resource discovery service that allows microservices to dynamically discover each other using DNS names or API calls. By integrating Cloud Map with ECS service discovery, tasks can register themselves with a namespace, enabling other services to resolve their IP addresses via DNS queries, which satisfies the requirement for DNS-based discovery.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.