hardMultiple ChoiceObjective-mapped
CISSP Is adopting a microservices architecture Practice Question
An organization is adopting a microservices architecture. Which security control is most effective for ensuring that inter-service communication is authenticated and authorized?
⚠ Common exam trap
The trap here is that candidates often pick JWT (Option C) because it is commonly used for user authentication, but they overlook that JWT alone does not encrypt the channel or provide mutual authentication between services, which is critical for inter-service communication in a microservices architecture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing mutual TLS (mTLS) between services
Mutual TLS (mTLS) is the most effective control because it provides both authentication and encryption for inter-service communication. In a microservices architecture, mTLS ensures that each service presents a valid X.509 certificate, and both sides verify each other's identity before any data exchange, preventing unauthorized or spoofed services from communicating. This aligns with the principle of zero trust, where no implicit trust is granted based on network location.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implementing mutual TLS (mTLS) between services
Why this is correct
Implementing mutual TLS (mTLS) between services establishes a robust security foundation by requiring both the client and server services to present and validate cryptographic certificates during connection establishment. This ensures strong, bidirectional identity verification, preventing unauthorized services from communicating. Furthermore, mTLS encrypts all data in transit, protecting sensitive information from eavesdropping and tampering, which is critical for maintaining confidentiality and integrity across a distributed microservices landscape.
- ✗
Relying on network segmentation and IP allowlisting
Why it's wrong here
Relying solely on network segmentation and IP allowlisting provides an insufficient security posture for microservices, as it primarily focuses on perimeter defense rather than granular service-level identity. While segmentation can reduce the attack surface, IP allowlisting is vulnerable to IP spoofing and does not authenticate the identity of the calling service, only its network origin. A compromised host within an allowed segment could freely interact with other services, bypassing this weak control and violating the principle of least privilege.
- ✗
Using JSON Web Tokens (JWT) in the HTTP header
Why it's wrong here
Using JSON Web Tokens (JWT) in the HTTP header primarily serves to convey authenticated user identity and authorization claims from an identity provider to a service, or between services for authorization purposes. However, JWTs themselves do not provide encryption for the transport layer or mutual authentication between the communicating services. While a JWT can assert who is authorized to perform an action, it does not cryptographically verify the identity of the service making the request or secure the communication channel against eavesdropping or man-in-the-middle attacks.
- ✗
Using pre-shared API keys for each service pair
Why it's wrong here
Pre-shared API keys offer a basic form of authentication, typically unidirectional, where a client service presents a secret key to identify itself to a server service. This method lacks mutual authentication, meaning the client does not verify the server's identity, making it susceptible to impersonation. Moreover, managing and securely distributing a large number of unique API keys for every service pair in a dynamic microservices environment becomes operationally complex and increases the risk of key compromise, especially if not protected by an underlying secure transport like TLS.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
TLS
Transport Layer Security (TLS) is a cryptographic protocol that encrypts data sent over the internet to keep it private and ensure it hasn’t been tampered with.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.