Question

Difficulty: HardSecure Network Design and Segmentation

A enterprise security architecture team is revising its infrastructure segmentation strategy to address specific threat models across varied operational zones. Match each network design architectural technique to the security requirement it fulfills.

  • Out-of-band (OOB) management network with a bastion hostIsolating administrative access to core switches and routers completely from standard employee workstations and general LAN traffic.
  • Software-defined microsegmentationEnforcing granular access controls to restrict lateral (East-West) traffic between workload instances residing within the same virtual subnet.
  • Screened subnet (DMZ) with multi-homed firewallsTerminating untrusted Internet traffic on public services while preventing direct inbound connections to backend enterprise database networks.
  • Physical air-gappingPreventing any network-based communication or remote intrusion vectors into high-consequence legacy SCADA control systems.

Answer

Out-of-band management with a bastion host pairs with administrative switch isolation; Software-defined microsegmentation pairs with restricting East-West lateral workload traffic; Screened subnets with multi-homed firewalls pair with terminating untrusted Internet traffic away from internal databases; Physical air-gapping pairs with preventing remote intrusion into sensitive SCADA systems.
Each architectural pattern matches its specific security objective: Out-of-band management secures network infrastructure access; Microsegmentation halts intra-subnet lateral movement; DMZs secure public endpoints while safeguarding backend assets; Air gaps eliminate remote connectivity risks for critical isolated systems.

Step-by-Step Solution

1
Analyze management plane isolation requirements.
Identified that out-of-band management with jump boxes isolates administrative control interfaces from general user LANs.
Prevents credential sniffing and unauthorized switch access over standard corporate subnets.
2
Evaluate intra-subnet lateral movement controls.
Matched microsegmentation with limiting East-West traffic between individual workloads in shared virtual subnets.
Standard network VLANs allow unrestrained communication within a broadcast domain, whereas microsegmentation enforces workload-to-workload policies.
3
Examine perimeter and backend database protection mechanisms.
Linked screened subnets (DMZs) to untrusted Internet termination and backend database isolation.
Screened subnets proxy or inspect external requests before allowing controlled connections to internal tiers.
4
Determine total physical isolation needs for sensitive operational technology.
Matched physical air-gapping to critical legacy SCADA systems.
Air-gapping ensures complete network disconnection when software patches or logical controls are insufficient.

Key Concept

Secure Network Design and Segmentation Archetypes
Rate this question