hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Migrating from a legacy three-tier architecture…
A company is migrating from a legacy three-tier architecture to a microservices architecture on Kubernetes. The security team wants to ensure that service-to-service communication is encrypted and mutually authenticated. Which approach best meets these requirements with minimal operational overhead?
⚠ Common exam trap
Many candidates choose IPsec or VPN solutions because they are familiar with network-layer encryption, but they fail to recognize that these approaches do not scale to the dynamic, ephemeral nature of microservices and introduce prohibitive operational overhead compared to a service mesh's automated mTLS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a service mesh with mutual TLS (mTLS) and automatic certificate management.
A service mesh with mutual TLS (mTLS) and automatic certificate management is the correct approach because it provides encrypted, mutually authenticated service-to-service communication with minimal operational overhead. The service mesh (e.g., Istio, Linkerd) transparently intercepts traffic via sidecar proxies, handles mTLS handshakes, and automates certificate issuance and rotation, eliminating the need for manual key distribution or application-level changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement a service mesh with mutual TLS (mTLS) and automatic certificate management.
Why this is correct
Service mesh provides automated mTLS, encryption, and mutual authentication with low operational overhead.
- ✗
Deploy IPsec tunnels between each pair of services using pre-shared keys.
Why it's wrong here
IPsec tunnels are static and do not scale with dynamic microservices.
- ✗
Establish a site-to-site VPN between the Kubernetes cluster and the legacy network, and route all service traffic through the VPN.
Why it's wrong here
VPNs are too coarse for microservices and introduce latency.
- ✗
Configure each service to use TLS with self-signed certificates, and distribute the CA certificate to all services.
Why it's wrong here
Self-signed certificates require manual distribution and renewal, increasing overhead.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.