A fire CAD analytics VLAN requires strong mutual authentication between the municipal orchestrator and cloud training API endpoints. Which secure-connectivity control fits that hybrid need?
Select an answer to reveal the explanation.
Short Explanation
When the civic orchestrator talks to cloud training APIs, both sides should prove who they are — mTLS or the equivalent. If you've got mTLS to your VLAN gateway, to the VPC endpoint, or even to logging APIs, that's still not proof to the training APIs — you've authenticated the wrong peer. Mutual auth is the grown-up move.
Full Explanation
A fire CAD analytics VLAN that requires strong mutual authentication between the municipal orchestrator and cloud training API endpoints should use mutual TLS or equivalent mutual authentication between those parties. Both sides prove identity before training control or data plane calls proceed—protecting the CAD analytics path from impersonation and unauthorized API use.
Mutual TLS or equivalent mutual authentication between orchestrator and civic VLAN gateway proves identity to the internal gateway, but it does not authenticate the cloud training API endpoint, so the orchestrator-to-cloud training path still lacks the required endpoint-to-endpoint assurance.
Mutual TLS or equivalent mutual authentication between data center edge and cloud VPC endpoint authenticates the network edges, but it does not mutually authenticate the municipal orchestrator and the cloud training API endpoints at the application layer.
Mutual TLS or equivalent mutual authentication between orchestrator and cloud logging APIs uses the right mechanism on the wrong API surface, so training control and data plane calls to the cloud training APIs would proceed without proving both training parties' identities.
Exam caveat: Domain 2.5 evaluates secure connectivity at application edges for hybrid AI; mutual authentication to a civic VLAN gateway, to a VPC endpoint, or to logging APIs does not satisfy mutual authentication to the cloud training APIs.
Operational check: enforce mTLS (or equivalent) on orchestrator ↔ cloud training API calls from the fire CAD VLAN, revoke a test client certificate, and confirm sessions fail closed. Prefer short-lived client certificates or workload identities scoped specifically to orchestrator-to-cloud-training-API identity from the municipal PKI or identity provider, not gateway, VPC-edge, or logging-API identities, and monitor for certificate expiry before CAD training jobs fail at the worst time. Mutual authentication without operational cert lifecycle still becomes an outage risk for the fire analytics hybrid path.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.