hardMultiple ChoiceObjective-mapped
PCSE Practice Question: A financial services company is deploying a…
A financial services company is deploying a multi-region application on Google Kubernetes Engine (GKE) and needs to comply with PCI DSS. They must ensure that cardholder data is encrypted in transit between pods in different clusters. What is the MOST secure way to achieve this?
⚠ Common exam trap
Google Cloud often tests the misconception that network-level encryption (e.g., VPC peering or internal Google Cloud encryption) is sufficient for compliance, but PCI DSS requires application-layer encryption (e.g., TLS/mTLS) for cardholder data in transit between pods.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Anthos Service Mesh with mutual TLS (mTLS) across clusters.
Anthos Service Mesh with mutual TLS (mTLS) provides authenticated and encrypted communication between pods across different GKE clusters, meeting PCI DSS encryption-in-transit requirements. mTLS ensures that each side of the connection presents a certificate, verifying identity and encrypting traffic at the application layer, which is more secure than relying solely on network-level encryption. This approach also integrates with GKE's multi-cluster service mesh capabilities, allowing fine-grained policy enforcement across clusters.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure TLS for each service using a Cloud Load Balancing with SSL policies.
Why it's wrong here
Cloud Load Balancing is for external traffic, not for pod-to-pod communication within the mesh.
- ✓
Enable Anthos Service Mesh with mutual TLS (mTLS) across clusters.
Why this is correct
mTLS in a service mesh provides encryption and authentication for inter-pod traffic.
- ✗
Use HTTPS between services by configuring ingress with a Google-managed SSL certificate.
Why it's wrong here
HTTPS is for external traffic; pods communicate internally over HTTP/gRPC.
- ✗
Use VPC Network Peering to connect the clusters and rely on the internal network encryption.
Why it's wrong here
VPC peering does not encrypt traffic; encryption must be applied at the application layer.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.