CND Application And Data Protection Practice Question

An organization wants to secure data in transit between microservices communicating within a Kubernetes cluster. Which service mesh technology provides mutual TLS (mTLS) encryption automatically between service pods without modifying application code?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Istio with Envoy sidecar proxies enforcing automatic mTLS

Istio (or Linkerd) is a service mesh that injects sidecar proxies (like Envoy) to automatically handle mutual TLS (mTLS) between Kubernetes pods.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Kubernetes Ingress Controller with basic HTTP routing
Why it's wrong here
Ingress controllers manage traffic entering the cluster from outside, not internal pod-to-pod mesh encryption.
✓
Istio with Envoy sidecar proxies enforcing automatic mTLS
Why this is correct
Istio uses Envoy sidecars to transparently encrypt service-to-service traffic using mTLS.
✗
Docker Swarm overlay networking with IPsec tunneling
Why it's wrong here
Docker Swarm is an alternative container orchestrator, not a Kubernetes service mesh.
✗
Apache ZooKeeper configuration management service
Why it's wrong here
ZooKeeper is a distributed coordination service, not a service mesh for mTLS.

About these practice questions

Courseiva writes every CND question from scratch — 323 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed August 2026 · checked against the official EC-Council exam blueprint

Ready to practise?

Put this into practice with a full scored session.

Start practice session

Scored practice sessions

Short scored sets — answer, get feedback, read the explanation, move on.

CND Practice Questions 1 — 50 Questions→Free CND Practice Test 3 — 30 Questions→

Domain-focused practice

Drill one exam section at a time instead of jumping between unrelated topics.

Application And Data Protection Incident Detection Response And Threat Prediction Network Defense Management

Practice by question type

Practise one question format at a time: exhibits, multi-select, drag-and-drop, troubleshooting.

Browse scenarios

Go deeper on a topic

One concept per page — questions, worked explanations, and a short concept guide.

Application And Data Protection practice questions Network Perimeter Protection practice questions CND troubleshooting practice questions CND fundamentals practice questions

Keep going

Study guide Exam domains CND practice test

This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.