hardMultiple ChoiceObjective-mapped
CISSP Practice Question: In a microservices architecture with a service…
In a microservices architecture with a service mesh, what is the most effective approach to secure inter-service communication?
⚠ Common exam trap
Candidates often choose 'TLS only' (Option B) thinking encryption alone is sufficient, but the CISSP exam emphasizes that in a zero-trust microservices environment, mutual authentication and identity-based authorization are critical to prevent impersonation and lateral movement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement mutual TLS (mTLS) and identity-based access policies
In a service mesh, mutual TLS (mTLS) provides both encryption and identity verification for every inter-service call, ensuring that only authenticated services with the correct identity can communicate. Identity-based access policies (e.g., using SPIFFE IDs) then enforce fine-grained authorization, which is essential in dynamic microservices environments where IP addresses are ephemeral. This combination directly addresses the core security requirements of confidentiality, integrity, and authentication in zero-trust architectures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Segment services into separate VLANs without encryption
Why it's wrong here
Segmenting services into separate VLANs without encryption provides only logical network isolation, which is insufficient for securing microservices traffic. While VLANs can limit broadcast domains, they do not encrypt data in transit between services within or across segments. This leaves communications vulnerable to eavesdropping or tampering by an attacker who gains access to the network, failing to protect against internal threats or ensure data confidentiality at the application layer.
- ✗
Use TLS only for all communication
Why it's wrong here
Using standard Transport Layer Security (TLS) only for all communication is inadequate because it typically provides only server-side authentication. While a client can verify the server's identity, the server cannot cryptographically verify the client's identity. In a microservices architecture, where services act as both clients and servers, mutual authentication is critical to establish trust and ensure that only authorized services can communicate with each other, which one-way TLS does not provide.
- ✓
Implement mutual TLS (mTLS) and identity-based access policies
Why this is correct
Implementing mutual TLS (mTLS) and identity-based access policies is the most robust approach for securing microservices in a service mesh. mTLS ensures strong, bidirectional cryptographic authentication between services, verifying both the client's and server's identities using certificates for every connection. Coupled with identity-based access policies, this enables fine-grained authorization decisions based on verified service identities, enforcing the principle of least privilege and establishing a zero-trust environment within the mesh.
- ✗
Rely on API keys in the request headers
Why it's wrong here
Relying solely on API keys in request headers for authentication is highly insecure for service-to-service communication in a microservices environment. API keys are static secrets that, if compromised or leaked, grant unauthorized access to the associated service without further cryptographic proof of identity. They lack the per-request authentication and robust key management capabilities provided by certificate-based systems like mTLS, making them susceptible to replay attacks and difficult to revoke effectively across a dynamic service landscape.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
TLS
Transport Layer Security (TLS) is a cryptographic protocol that encrypts data sent over the internet to keep it private and ensure it hasn’t been tampered with.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.