CAS-004 Security Engineering Practice Question
A security architect is designing a microservices-based application deployed on a Kubernetes cluster. The architect must ensure that inter-service communication is encrypted, mutually authenticated, and that services can be authorized based on their identity. Which of the following should the architect implement to meet these requirements?
⚠ Common exam trap
Test-takers frequently confuse network segmentation or API gateways with service mesh capabilities; only a service mesh provides built-in mTLS and identity-based authorization for inter-service traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a service mesh with mutual TLS (mTLS) and identity-based authorization policies.
A service mesh with mTLS provides transparent encryption and mutual authentication for all service-to-service communication, using verifiable identities. Its authorization policies can enforce access based on those identities, which is essential for zero-trust microservices. The other options either lack encryption, mutual authentication, or are limited to external traffic, failing to secure east-west communication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Kubernetes Secrets to store TLS certificates and manually configure each service to use them.
Why it's wrong here
Storing certificates in Secrets and manually configuring each service is error-prone and does not scale. It also lacks automated certificate rotation and identity-based authorization. While it can provide encryption and authentication, it does not offer the centralized policy enforcement and identity management that a service mesh provides, making it less suitable for a microservices architecture.
- ✗
Implement an API gateway that terminates TLS and performs authentication for all inbound traffic.
Why it's wrong here
An API gateway typically handles north-south traffic (external to internal), not east-west traffic between microservices. It can terminate TLS and authenticate external clients, but it does not secure inter-service communication within the cluster. It also does not provide mutual authentication between services or identity-based authorization for internal calls.
- ✓
Deploy a service mesh with mutual TLS (mTLS) and identity-based authorization policies.
Why this is correct
A service mesh such as Istio or Linkerd provides transparent mTLS for all inter-service communication, encrypting traffic and authenticating both ends using service identities (e.g., SPIFFE IDs). It also enables fine-grained authorization policies based on those identities. This directly satisfies the requirements for encryption, mutual authentication, and identity-based authorization.
- ✗
Configure Kubernetes Network Policies to allow only specific pod-to-pod traffic.
Why it's wrong here
Network Policies control traffic flow at the IP address or port level within a cluster, but they do not provide encryption or mutual authentication. They operate at Layer 3/4 and cannot verify service identity. While useful for segmentation, they fail to meet the requirements for encrypted, mutually authenticated communication and identity-based authorization.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 973-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.