Your security architecture requires that the Instana backend not only present a valid TLS certificate to agents, but also that each agent authenticate itself to the backend using a client certificate — implementing mutual TLS (mTLS). Which configuration correctly implements this requirement?

Mutual TLS requires both the server (Instana backend) and the client (Instana agent) to present and verify X.509 certificates during the TLS handshake, establishing bidirectional authentication rather than server-only authentication. This is implemented by providing each agent with a client key and certificate file and configuring the Instana backend to require and validate client certificate presentation. Options using 2FA, API tokens, or ssl.verify: false either address user authentication, use a different credential type, or weaken rather than strengthen transport security. The correct answer is 'Configure client certificates (key and certificate files) in each Instana agent and ensure the Instana backend is configured to require and validate client certificates presented during the TLS handshake'. The incorrect options — 'Enable two-factor authentication (2FA) for all Instana user accounts, which automatically extends certificate-based verification to agent connections', 'Set ssl: true and provide an API token in the agent configuration to serve as a cryptographic substitute for client certificate authentication', 'Generate a self-signed certificate on the backend and configure agents to skip server certificate verification using ssl.verify: false' — are wrong because they do not align with IBM Instana's architecture or recommended practices for this scenario. Understanding this concept is essential for the Domain 7: Security/Compliance domain of the IBM Instana Observability certification.