A network security architect wants to implement network policy enforcement ensuring that only authorized systems can communicate with production database servers. Which approach provides the strongest guarantee without relying solely on firewall rules?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because mTLS requires both the client (application server) and server (database) to present valid certificates during the TLS handshake; even if an attacker bypasses the firewall, they cannot establish a connection to the database without a valid client certificate provisioned by the organization's PKI. A is wrong because firewall rules provide perimeter enforcement but can be bypassed if an attacker compromises an authorized application server; mTLS adds a cryptographic identity layer.
Full explanation below image
Full Explanation
B is correct because mTLS requires both the client (application server) and server (database) to present valid certificates during the TLS handshake; even if an attacker bypasses the firewall, they cannot establish a connection to the database without a valid client certificate provisioned by the organization's PKI. A is wrong because firewall rules provide perimeter enforcement but can be bypassed if an attacker compromises an authorized application server; mTLS adds a cryptographic identity layer. C is wrong because IPS inspects for attack patterns but does not enforce identity-based access control for legitimate connections. D is wrong because password complexity addresses credential strength but does not prevent network-level access by unauthorized systems.