Examkin

Question

Difficulty: MediumSecure Network Design and Segmentation

A financial organization is incorporating a legacy mainframe transaction processing engine into its modern hybrid data center architecture. The legacy system cannot support modern endpoint detection software or host-based firewalls, but it must securely accept transactions from front-end web servers while strictly preventing unauthorized lateral movement to adjacent enterprise database subnets. Which network architecture decision best isolates the legacy system while managing East-West traffic risks?

  1. Implement microsegmentation using software-defined networking rules and application proxy gateways between network zones.Answer
  2. B
    Place the legacy transaction engine in the internal core server VLAN and rely on the network edge perimeter firewall to filter incoming traffic.
  3. C
    Deploy a network intrusion detection system in passive monitoring mode on the core switch to log unverified lateral traffic flows.
  4. D
    Establish a physical air gap around the legacy transaction engine and update transaction logs using offline removable media.

Answer

Enforcing microsegmentation using software-defined networking and application proxy gateways provides granular, preventive East-West traffic control around legacy systems without requiring host-level agents.
Microsegmentation partitions the data center into isolated logical zones down to individual workload levels. Combined with proxy gateways, it enforces strict Zero Trust policy controls over lateral (East-West) traffic without needing agent software installed on the legacy endpoint.

Step-by-Step Solution

1
Analyze the operational constraints and threat model for the legacy mainframe system.
Determine that host-based firewalls cannot be installed and that the main risk vector is lateral (East-West) movement from compromised internal web or database servers.
Legacy devices without modern host controls must be shielded at the network layer.
2
Evaluate segmentation strategies capable of restricting East-West traffic while permitting legitimate API requests.
Identify microsegmentation with proxy gateways as the optimal mechanism to create isolated security boundaries around specific workloads.
Microsegmentation enforces explicit allow rules between defined network workloads regardless of physical network topology.
3
Reject ineffective or overly restrictive isolation options.
Eliminate perimeter-only defense (lacks internal lateral prevention), passive NIDS (detective, not preventive), and physical air-gapping (disrupts necessary real-time connectivity).
Secure network design must balance required operational functionality with preventive security controls.

Key Concept

Microsegmentation and East-West Traffic Isolation
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic