CCSP Cloud Application Security Practice Question
A company is migrating a legacy monolithic application to a cloud-native microservices architecture. The security architect is concerned about securing inter-service communication. Which of the following should be implemented to ensure mutual authentication and encryption between services?
⚠ Common exam trap
ISC2 often tests the misconception that network segmentation (VPC/security groups) alone is sufficient for securing inter-service communication, but the CCSP emphasizes that encryption and mutual authentication are required for data-in-transit security in a zero-trust model.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a service mesh with mutual TLS (mTLS) for all inter-service communication.
A service mesh with mutual TLS (mTLS) provides both encryption and mutual authentication for inter-service communication, ensuring that each service verifies the identity of the other before exchanging data. This is the recommended approach for cloud-native microservices because it offloads security concerns from application code and uses X.509 certificates to establish trust, aligning with zero-trust principles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy a service mesh with mutual TLS (mTLS) for all inter-service communication.
Why this is correct
A service mesh like Istio automates mTLS, providing strong encryption and mutual authentication.
- ✗
Use shared API keys embedded in each service's configuration.
Why it's wrong here
Shared keys are a security risk and do not provide mutual authentication.
- ✗
Implement TLS termination at the load balancer with internal certificates.
Why it's wrong here
This encrypts traffic but does not ensure mutual authentication between services.
- ✗
Place all services in the same Virtual Private Cloud (VPC) and restrict ingress with security groups.
Why it's wrong here
Network controls alone do not provide service-level authentication.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.