mediumMultiple ChoiceObjective-mapped
CCSP mutual TLS (mTLS) Practice Question
A healthcare organization is using a cloud-based electronic health record (EHR) system hosted on a PaaS platform. The platform provides a web interface and an API for integration with internal systems. The organization's security policy requires encryption of all data at rest and in transit. They have implemented SSL/TLS for data in transit and enabled server-side encryption for the database. However, during a recent audit, it was discovered that the API returns diagnostic data in clear text when accessed from internal networks. The internal network is considered trusted. The auditor recommends implementing end-to-end encryption. Which of the following is the BEST approach to meet this requirement?
⚠ Common exam trap
The auditor recommends end-to-end encryption, which typically requires both authentication and encryption between the client and server. mTLS directly addresses both, while options like client-side encryption or VPNs either miss one aspect or add unnecessary complexity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the API to require mutual TLS (mTLS) authentication and use TLS 1.2 or higher for all connections from internal systems.
The best approach because mutual TLS (mTLS) provides both authentication of internal clients and encryption of data in transit, achieving end-to-end encryption without adding unnecessary complexity. mTLS ensures that only authorized systems can call the API and that all data is encrypted from client to server. Option B (client-side encryption) does not protect data in transit between the client and the API unless combined with TLS, and it introduces key management overhead. Option C (VPN) adds latency and complexity, and while it encrypts traffic, it does not provide per-connection authentication for each API call. Option D (proxy service) introduces an additional component that could become a bottleneck or point of failure, and still requires TLS between the proxy and the API to maintain end-to-end encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the API to require mutual TLS (mTLS) authentication and use TLS 1.2 or higher for all connections from internal systems.
Why this is correct
mTLS ensures both parties are authenticated and the communication is encrypted, providing end-to-end encryption.
- ✗
Implement client-side encryption on the internal systems before sending data to the API.
Why it's wrong here
This puts the burden of encryption on the client and may not cover all data; also, the API might still process unencrypted data if decryption is not handled correctly.
- ✗
Set up a VPN connection between the internal network and the cloud PaaS environment to encrypt all traffic.
Why it's wrong here
VPN encrypts traffic but may be overkill and can impact performance; also, it does not address encryption at the application level.
- ✗
Create a proxy service in the cloud that encrypts the data before forwarding it to the API.
Why it's wrong here
This adds complexity and a potential single point of failure; encryption is still not end-to-end if the proxy decrypts it.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.