The most effective method to secure inter-service communication in a service mesh is to implement mutual TLS (mTLS) combined with identity-based access policies. This approach ensures that every service-to-service call is both encrypted in transit and mutually authenticated, meaning each service cryptographically proves its identity to the other before any data is exchanged. On the Certified Information Systems Security Professional CISSP exam, this concept tests your understanding of how a service mesh offloads security controls from application code to the infrastructure layer, a key distinction from traditional TLS which only verifies the server. A common trap is assuming that standard TLS or API keys provide sufficient protection, but mTLS is the only option that prevents man-in-the-middle attacks and enforces granular, identity-driven authorization at scale. Remember the mnemonic “MATE” for mTLS: Mutual Authentication, Trust, Encryption—without all three, inter-service calls remain vulnerable.
CISSP Software Development Security Practice Question
This CISSP practice question tests your understanding of software development security. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
In a microservices architecture with a service mesh, what is the most effective approach to secure inter-service communication?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement mutual TLS (mTLS) and identity-based access policies
Option A is correct because mutual TLS (mTLS) with identity-based policies authenticates and encrypts each service-to-service call. Option B is wrong because TLS alone does not authenticate the caller. Option C is wrong because API keys are less secure and harder to manage at scale. Option D is wrong because network segmentation without encryption does not protect against eavesdropping.
Key principle: A trunk being up does not mean the VLAN is allowed across it. Always verify the allowed VLAN list and whether the VLAN exists on both switches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Segment services into separate VLANs without encryption
Why it's wrong here
Network segmentation does not protect against internal threats.
Implement mutual TLS (mTLS) and identity-based access policies
Why this is correct
mTLS provides strong authentication and encryption per request.
Related concept
Access ports place end devices into a single VLAN.
✗
Rely on API keys in the request headers
Why it's wrong here
API keys can be leaked and do not provide per-request authentication.
Common exam traps
Common exam trap: an active trunk can still block the VLAN you need
A trunk being up does not prove every VLAN is crossing it. Check allowed VLAN lists, native VLAN mismatch, VLAN existence and access-port assignment.
Detailed technical explanation
How to think about this question
VLAN questions usually combine access-port and trunking clues. The key is to identify whether the issue is local to one switchport, caused by the trunk, or caused by the VLAN not existing where it needs to exist.
KKey Concepts to Remember
Access ports place end devices into a single VLAN.
Trunk ports carry multiple VLANs between switches.
Allowed VLAN lists decide which VLANs can cross a trunk.
Native VLAN mismatch can create confusing symptoms.
TExam Day Tips
→Use show vlan brief to verify access VLANs.
→Use show interfaces trunk to verify trunk state and allowed VLANs.
→Do not treat every same-VLAN issue as a routing problem.
Key takeaway
A trunk being up does not mean the VLAN is allowed across it. Always verify the allowed VLAN list and whether the VLAN exists on both switches.
Real-world example
How this comes up in practice
A developer is choosing between AES-256 (symmetric) and RSA-2048 (asymmetric) for encrypting a large file that will be sent to a partner. Symmetric encryption is fast but requires key exchange; asymmetric is slower but solves the key distribution problem. A hybrid approach — encrypt the file with AES, encrypt the AES key with RSA — is standard. Questions like this test whether you understand when each approach applies.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CISSP question in full detail.
Review VLAN allowed lists, native VLAN mismatch detection, and how to verify VLAN membership with show vlan brief and show interfaces trunk. Then practise related CISSP questions on switching, trunking, and access-port configuration.
Software Development Security — This question tests Software Development Security — Access ports place end devices into a single VLAN..
What is the correct answer to this question?
The correct answer is: Implement mutual TLS (mTLS) and identity-based access policies — Option A is correct because mutual TLS (mTLS) with identity-based policies authenticates and encrypts each service-to-service call. Option B is wrong because TLS alone does not authenticate the caller. Option C is wrong because API keys are less secure and harder to manage at scale. Option D is wrong because network segmentation without encryption does not protect against eavesdropping.
What should I do if I get this CISSP question wrong?
Review VLAN allowed lists, native VLAN mismatch detection, and how to verify VLAN membership with show vlan brief and show interfaces trunk. Then practise related CISSP questions on switching, trunking, and access-port configuration.
What is the key concept behind this question?
Access ports place end devices into a single VLAN.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.