mediumMultiple SelectObjective-mapped
CAS-004 Practice Question: Migrating its monolithic application to a…
A company is migrating its monolithic application to a microservices architecture. The security team wants to implement controls to protect inter-service communication and ensure data integrity. Which THREE security controls should be implemented? (Select THREE.)
⚠ Common exam trap
CompTIA often tests the distinction between data-at-rest and data-in-transit controls, so candidates mistakenly select 'encrypt data at rest' (Option A) when the question explicitly asks about protecting inter-service communication, which requires in-transit protections like mTLS or API gateway authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy an API gateway to enforce rate limiting and authentication
An API gateway acts as a single entry point for all service calls, enforcing rate limiting to prevent abuse and authentication (e.g., OAuth2, JWT) to verify identity before requests reach backend microservices. This centralizes security policy enforcement and protects inter-service communication by reducing the attack surface. Option C is correct because mutual TLS (mTLS) provides strong service-to-service authentication and encryption for data in transit. With mTLS, each service presents a certificate to verify its identity, and the TLS handshake ensures all communication is encrypted and integrity-protected, preventing eavesdropping and man-in-the-middle attacks. Option D is correct because a container orchestration platform (e.g., Kubernetes) can enforce network policies that restrict communication between services, ensuring only authorized service-to-service interactions. This provides an additional layer of security for inter-service communication beyond the API gateway and mTLS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypt data at rest using AES-256
Why it's wrong here
Encrypting data at rest protects stored data, not inter-service communication in transit. This is not a control for the stated requirement.
- ✓
Deploy an API gateway to enforce rate limiting and authentication
Why this is correct
Correct. An API gateway centralizes authentication and rate limiting, protecting inter-service communication.
- ✓
Implement mutual TLS (mTLS) for service-to-service authentication
Why this is correct
Correct. mTLS provides strong authentication and encryption for service-to-service communication.
- ✓
Use a container orchestration platform to manage service discovery
Why this is correct
Correct. Container orchestration platforms can enforce network policies to restrict and secure inter-service communication.
- ✗
Conduct static code analysis on all microservices
Why it's wrong here
Static code analysis is a development-time security practice, not a runtime control for inter-service communication.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.