Which two capabilities are standard within a service mesh?

Service mesh technology, such as Istio integrated within VMware Cloud Foundation (VCF) 9.0 and vSphere Kubernetes Service (VKS), is designed to solve the complexities of microservices communication. Two of the most fundamental capabilities provided by a service mesh are Service discovery and Connection encryption . In a dynamic Kubernetes environment where pods are frequently created and destroyed, Service discovery allows microservices to locate and communicate with each other automatically without requiring hardcoded IP addresses or manual configuration changes. The service mesh control plane maintains a real-time registry of all active service instances and their locations.

Secondly, Connection encryption is a pillar of the " Zero Trust " security model implemented in VCF 9.0. By utilizing a sidecar proxy (like Envoy) deployed alongside every container, the service mesh automatically manages mutual TLS (mTLS) for all inter-service traffic. This ensures that data in transit is encrypted and that services can cryptographically verify the identity of their peers before establishing a connection. While capabilities like backup/restore (Option D) and container runtimes (Option A) are critical components of the broader VCF platform (handled by Velero and containerd respectively), they are not functions of the service mesh itself. The service mesh specifically focuses on the " Layer 7 " networking aspects—observability, reliability, and security—of the application traffic, making service discovery and encryption its core functional requirements.