Examkin

Question

Difficulty: MediumSecure Network Design and Segmentation

A financial enterprise is deploying a third-party reporting server into a virtualized datacenter. The reporting server requires outbound internet access to fetch external market data, but corporate security policy dictates that it must be strictly prevented from initiating lateral connections to any other internal virtual machines, even those within the same subnet. Which of the following network architecture design solutions best satisfies this requirement?

  1. Implement microsegmentation policies using a software-defined network or host-based firewall rules to control east-west traffic at the hypervisor level.Answer
  2. B
    Position the reporting server in a traditional edge perimeter DMZ and rely on the main enterprise boundary firewall to restrict internal access.
  3. C
    Deploy a dual-homed jump box to proxy management requests from the administration network to the reporting server.
  4. D
    Place the reporting server behind an air-gapped physical network interface to physically isolate all network communications.

Answer

Implementing microsegmentation policies using software-defined networking or granular host/hypervisor firewall rules provides the necessary east-west traffic control to prevent lateral movement within the same subnet while maintaining required internet connectivity.
Microsegmentation applies granular, software-defined security policies at the individual workload or hypervisor level. This enables strict filtering of east-west traffic, preventing the reporting server from initiating connections to adjacent internal virtual machines regardless of network topology, while allowing specific outbound north-south internet traffic.

Step-by-Step Solution

1
Analyze the operational and security requirements
The server needs outbound internet connectivity (north-south traffic), but must not initiate lateral connections to adjacent internal systems (east-west traffic), including hosts on its local subnet.
Security controls must enforce granular isolation without severing required external communications.
2
Evaluate segmentation methodologies against lateral traffic control
Traditional subnets and perimeter DMZs permit uninspected traffic between hosts within the same VLAN/subnet. Air-gapping severs all connectivity including required internet access.
Microsegmentation abstracts security policies down to individual workloads or hypervisors, enabling zero-trust east-west filtering.
3
Select the optimal architecture control
Microsegmentation policies effectively isolate the host from lateral peers while permitting intended outbound paths.
This satisfies both PCI/enterprise compliance rules and functional requirements.

Key Concept

Microsegmentation and East-West Traffic Isolation
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic