CCSP Cloud Application Security Practice Question
A cloud team is designing a new microservices application deployed on a managed Kubernetes service. The security architect requires that all service-to-service traffic be encrypted with mutual TLS (mTLS) without modifying application code. Which cloud-native component should be implemented to meet this requirement?
⚠ Common exam trap
The trap here is assuming that a WAF or API gateway provides internal service-to-service encryption, when they only protect traffic at the perimeter or ingress.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A service mesh such as Istio or Linkerd
A service mesh is the correct cloud-native solution because it provides transparent mTLS between services through sidecar proxies, requiring no application code changes. It also enables fine-grained authorization and observability. Other options address perimeter security or network segmentation but do not deliver encrypted, mutually authenticated service-to-service communication inside the cluster.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An API gateway with TLS termination at the ingress
Why it's wrong here
An API gateway with TLS termination encrypts traffic only between external clients and the gateway. Once traffic enters the cluster, it is typically decrypted, so service-to-service communication remains in plaintext. This does not provide the end-to-end mTLS required between all internal microservices, and it does not authenticate individual service identities.
- ✗
Kubernetes NetworkPolicy objects with default deny rules
Why it's wrong here
NetworkPolicy controls which pods can communicate based on labels, IP blocks, and ports, but it does not encrypt traffic or authenticate service identities. It is a segmentation control, not a cryptographic one. While useful for zero-trust networking, it cannot satisfy the requirement for mutual TLS encryption without application code changes.
- ✓
A service mesh such as Istio or Linkerd
Why this is correct
A service mesh injects sidecar proxies that transparently intercept and encrypt traffic between services using mTLS, satisfying the no-code-change requirement. It also provides identity-based authentication and authorization. This is the standard cloud-native approach for zero-trust service communication in Kubernetes environments, and it operates at the platform layer rather than within the application.
- ✗
A web application firewall (WAF) in front of each service
Why it's wrong here
A WAF inspects and filters HTTP traffic at the application layer, primarily protecting against injection and other web attacks. It does not provide mutual authentication or encryption between internal services, and it cannot enforce identity-based mTLS. Placing a WAF in front of each microservice would also add significant complexity and latency without meeting the encryption requirement.
Go deeper
Related to this question
About these practice questions
One of 934 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.