A network security architect wants to implement network policy enforcement ensuring that only authorized systems can communicate with production database servers. Which approach provides the strongest guarantee without relying solely on firewall rules?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — mutual TLS is the strongest choice because it forces both the application server and database server to present valid certificates during the TLS handshake. Even if an attacker gets past the firewall, they can't connect to the database without a valid client certificate issued by your PKI. Firewall rules alone can be bypassed if an authorized application server is compromised, so mTLS adds a cryptographic identity layer.
Full Explanation
The mutual TLS approach, combined with firewall rules, is correct because mTLS requires both the client (application server) and server (database) to present valid certificates during the TLS handshake; even if an attacker bypasses the firewall, they cannot establish a connection to the database without a valid client certificate provisioned by the organization's PKI. The firewall-only approach is wrong because firewall rules provide perimeter enforcement but can be bypassed if an attacker compromises an authorized application server; mTLS adds a cryptographic identity layer. The network-based IPS approach is wrong because IPS inspects for attack patterns but does not enforce identity-based access control for legitimate connections. The password complexity approach is wrong because password complexity addresses credential strength but does not prevent network-level access by unauthorized systems.