ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Amazon API Gateway's native mutual TLS capability can be enabled on a custom domain so that each calling microservice must present an X.509 certificate signed by a trusted private certificate authority. Using AWS Private CA to issue and rotate a unique certificate for each microservice allows fine-grained identification of callers. API Gateway performs the TLS handshake and certificate verification automatically, eliminating the need to develop and maintain custom Lambda authorizers. In contrast, an HMAC scheme with shared secrets stored in Secrets Manager provides integrity and basic authentication but lacks certificate-based mutual authentication. Cognito JWT access tokens are signed by the identity provider, not the microservice, and do not establish a mutually authenticated TLS channel. Network ACLs and VPC Flow Logs can restrict or record traffic but offer no cryptographic client authentication.