A security engineer auditing Instana deployments finds that several agents are configured to communicate with the Instana backend over an unencrypted channel. Which agent configuration change ensures all agent-to-backend communication is encrypted with TLS?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Instana agents communicate with the backend using HTTPS when the backend URL is configured with the https:// scheme and ssl: true is explicitly set in the agent configuration file. This ensures that all telemetry — metrics, traces, and events — is transmitted over an encrypted TLS channel between the agent and the Instana backend. Setting ssl: false explicitly disables TLS rather than enabling it, and a local reverse proxy does not address the agent's own outbound communication channel configuration.
Full explanation below image
Full Explanation
Instana agents communicate with the backend using HTTPS when the backend URL is configured with the https:// scheme and ssl: true is explicitly set in the agent configuration file. This ensures that all telemetry — metrics, traces, and events — is transmitted over an encrypted TLS channel between the agent and the Instana backend. Setting ssl: false explicitly disables TLS rather than enabling it, and a local reverse proxy does not address the agent's own outbound communication channel configuration. The correct answer is 'Ensure the backend host entry in the agent configuration uses https:// and set ssl: true so the agent enforces TLS for all telemetry transmission to the backend'. The incorrect options — "Set ssl: false in the agent's configuration.yaml to disable legacy plaintext mode and trigger automatic upgrade negotiation", "Add an ssl.certificate entry pointing to the agent host's local operating system certificate store", 'Install an nginx reverse proxy on each monitored host to terminate TLS before forwarding data to the local agent process' — are wrong because they do not align with IBM Instana's architecture or recommended practices for this scenario. Understanding this concept is essential for the Domain 7: Security/Compliance domain of the IBM Instana Observability certification.