Question 140 of 968
hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A company deploys a microservices architecture…
A company deploys a microservices architecture using container orchestration. The security team wants to enforce mutual TLS between services. Which technology should be used?
⚠ Common exam trap
Many candidates confuse an API gateway's ability to terminate TLS for external traffic with the need for mTLS between internal services, leading them to incorrectly select API gateway instead of service mesh.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Service mesh
A service mesh (e.g., Istio, Linkerd) is the correct technology because it provides a dedicated infrastructure layer for handling service-to-service communication, including automatic mutual TLS (mTLS) enforcement between microservices. It injects sidecar proxies that intercept all traffic and negotiate mTLS using X.509 certificates, ensuring both encryption and authentication without modifying application code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Service mesh
Why this is correct
A service mesh transparently injects sidecar proxies to handle mTLS encryption and authentication between services.
- ✗
SSH tunneling
Why it's wrong here
SSH tunneling is not scalable for a microservices environment and requires manual configuration.
- ✗
API gateway
Why it's wrong here
API gateways manage external API traffic, not internal service-to-service authentication.
- ✗
VPN
Why it's wrong here
VPNs establish a network-layer tunnel, not per-service mTLS, and add latency.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jul 4, 2026
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.