CCSP Cloud Application Security Practice Question
A financial services company is adopting a cloud-native microservices architecture. They want to ensure that only authorized services can communicate with each other, and that all inter-service communication is encrypted. Which of the following is the BEST approach?
⚠ Common exam trap
A common misconception is that network-layer controls (like NSGs or VPC peering) are sufficient for service-to-service security, but the CCSP emphasizes that cloud-native architectures require identity-based authentication and encryption at the application or transport layer, which only a service mesh with mTLS provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a service mesh with mutual TLS (mTLS) and fine-grained access policies
A service mesh with mutual TLS (mTLS) provides both encryption and identity-based authorization for inter-service communication. mTLS ensures that each service presents a valid certificate, proving its identity, and the mesh's control plane enforces fine-grained access policies (e.g., which services can call which endpoints). This directly meets the requirement for authorized, encrypted communication in a cloud-native microservices architecture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use network security groups to restrict traffic between service subnets
Why it's wrong here
Security groups provide network-layer filtering but no encryption or service identity.
- ✓
Implement a service mesh with mutual TLS (mTLS) and fine-grained access policies
Why this is correct
Service mesh provides encryption, identity, and policy enforcement at the application layer.
- ✗
Connect services using VPC peering and enable encryption in transit
Why it's wrong here
VPC peering connects networks but does not provide per-service authorization or encryption automatically.
- ✗
Deploy an API gateway and route all internal traffic through it
Why it's wrong here
API gateway is for external facing; internal traffic would introduce latency and bottleneck.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.