hardMultiple SelectObjective-mapped
CAS-004 Practice Question: A security architect is planning the migration of…
A security architect is planning the migration of a legacy application to a containerized microservices architecture on Kubernetes. The architect must ensure that the architecture supports secrets management, service-to-service authentication, and encryption of data in transit between microservices. Which THREE components should the architect include in the design? (Choose three.)
⚠ Common exam trap
The CAS-004 exam often tests the distinction between network segmentation (network policies) and cryptographic controls (mTLS, TLS), leading candidates to mistakenly choose network policies as a solution for encryption or authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a TLS termination gateway (e.g., NGINX ingress) with certificate management.
A TLS termination gateway (e.g., NGINX ingress) with certificate management provides encryption of data in transit between external clients and the Kubernetes cluster, fulfilling the requirement for encryption of data in transit at the edge. It terminates TLS at the ingress point, allowing secure HTTPS connections and centralized certificate lifecycle management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy a TLS termination gateway (e.g., NGINX ingress) with certificate management.
Why this is correct
Terminates external TLS and can re-encrypt internally; manages certificates for external-facing services.
- ✓
Use Kubernetes Secrets mounted as volumes with integration to an external vault.
Why this is correct
Kubernetes Secrets store sensitive data; integrating with an external vault ensures secure access and rotation.
- ✗
Apply Kubernetes network policies to restrict pod-to-pod communication.
Why it's wrong here
Network policies control traffic flow but do not provide encryption or authentication.
- ✓
Implement a service mesh such as Istio to handle mTLS between pods.
Why this is correct
Service mesh provides mutual TLS, authentication, and encryption between microservices.
- ✗
Configure RPM package signing for all container images.
Why it's wrong here
RPM signing is for binary packages, not container images; container images use image signing (e.g., Notary).
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.