SAP-C02 Design for New Solutions Practice Question
A company is designing a microservices architecture on Amazon ECS with Fargate. The services need to communicate securely and efficiently. The company wants to implement service-to-service authentication and authorization. Which THREE steps should the company take? (Choose THREE.)
⚠ Common exam trap
It's easy for candidates to confuse mTLS with standard TLS or assume ACM can be used for internal mTLS, but ACM does not support issuing client certificates for service-to-service mutual authentication in ECS Fargate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Secrets Manager to store and rotate service credentials.
AWS Secrets Manager provides a secure way to store and automatically rotate service credentials (such as database passwords or API keys) used by microservices running on ECS Fargate. This eliminates hard-coded secrets and reduces the risk of credential exposure, aligning with security best practices for service-to-service authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS Secrets Manager to store and rotate service credentials.
Why this is correct
Secrets Manager securely stores credentials for database or API keys.
- ✗
Configure mutual TLS (mTLS) between services using certificates from ACM.
Why it's wrong here
mTLS is possible but adds complexity; Service Connect already provides encryption.
- ✓
Enable ECS Service Connect between services for automatic DNS and TLS encryption.
Why this is correct
Service Connect provides secure service discovery and encryption.
- ✗
Deploy an API Gateway in front of each microservice.
Why it's wrong here
API Gateway is for external APIs, not internal service-to-service communication.
- ✓
Use IAM roles for tasks and attach policies that allow access to other services.
Why this is correct
IAM roles grant permissions for tasks to call other AWS services.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.