mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Deploying a new web application that handles…
A company is deploying a new web application that handles sensitive customer data. The application is built using a microservices architecture running in containers on a Kubernetes cluster. The security team wants to implement mutual TLS (mTLS) for service-to-service communication. However, they are concerned about the operational overhead of certificate management. Which approach minimizes management overhead while still ensuring strong authentication?
⚠ Common exam trap
A common trap is assuming that a single shared certificate or TLS termination at the edge is sufficient for internal security. However, mTLS requires per-service identity and encryption end-to-end, not just at the perimeter.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a service mesh that provides automatic mTLS and certificate rotation
A service mesh (e.g., Istio, Linkerd) automates mTLS by injecting sidecar proxies that handle certificate issuance, validation, and rotation via a built-in certificate authority (CA). This eliminates manual certificate management while ensuring strong, per-service authentication and encryption, directly addressing the operational overhead concern.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Generate self-signed certificates for each service and manually distribute them
Why it's wrong here
Operationally heavy and not scalable.
- ✓
Use a service mesh that provides automatic mTLS and certificate rotation
Why this is correct
Service mesh handles lifecycle automatically.
- ✗
Use a single certificate for all services with Subject Alternative Names
Why it's wrong here
Single certificate reduces security and complicates revocation.
- ✗
Implement TLS termination at the ingress and use plaintext inside the cluster
Why it's wrong here
Compromises internal communication security.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.