Microservices in a company's cloud application communicate with each other over plain HTTP inside a virtual network, on the assumption that the network is private. A threat model notes that a compromised service could impersonate others or read their traffic. Which control best addresses this?
Select an answer to reveal the explanation.
Short Explanation
Trusting the network just because it's internal is like leaving your office doors open because the building has a front desk. Mutual TLS makes each service show its ID and encrypts the conversation, so a compromised neighbor can't eavesdrop or pretend to be someone else. A WAF at the edge never even sees this east-west traffic.
Full Explanation
Communication protection requires confidentiality, integrity and authentication of traffic in transit, including east-west traffic between internal components. Mutual TLS gives each service a certificate, typically issued and rotated automatically by a service mesh or internal certificate authority; both sides verify each other's identity during the handshake, and the session is encrypted and integrity protected. A compromised service can then neither read other services' traffic nor impersonate them, because it lacks their private keys, and authorization policies can be enforced based on verified service identity. Restricting the address range keeps services on internal addresses, but internal addressing was already the assumption, and an attacker inside the network uses those same addresses, so it neither authenticates nor encrypts. A web application firewall at the internet edge inspects north-south traffic entering the application; it does not see or protect traffic between microservices within the virtual network. Compression is a reversible encoding for efficiency; any attacker who captures traffic can decompress it, and it offers no authentication. Exam caveat: assuming internal networks are trustworthy is the perimeter mindset that modern cloud architecture rejects. Operational check: attempt a plain HTTP call between two services and confirm it is refused, and verify that certificates rotate automatically.