Examkin

Question

Difficulty: MediumSecure Network Design and Segmentation

A security administrator must securely access an internal database server located within a restricted database zone from a remote management workstation. Place the following connection and transit steps in the correct sequential order from initial external access to final database session establishment according to secure network design principles.

  1. 1Authenticate to the perimeter bastion host (jump box) in the management DMZ using multi-factor authentication (MFA).
  2. 2Pass host posture checking and centralized AAA authorization controls on the bastion host.
  3. 3Traverse the internal stateful firewall via an explicit rule permitting traffic only from the bastion host IP to the database subnet.
  4. 4Establish a privileged database session on the target server within the isolated database subnet.

Answer

The correct sequence starts with authenticating to the DMZ bastion host using MFA, passing posture and AAA checks on the bastion, traversing the internal stateful firewall via restrictive bastion-to-database rules, and finally establishing the privileged database session.
Secure network design dictates that administrative access to sensitive internal zones (such as a database subnet) must pass through a jump server located within a DMZ or management zone. First, the administrator must authenticate to the bastion host using MFA. Second, device posture and AAA authorization controls evaluate the session on the bastion host. Third, the connection traverses the internal stateful firewall, which uses tight microsegmentation rules to permit transit only from the bastion host IP address to the database server port. Finally, the user establishes the authenticated session on the internal target database.

Step-by-Step Solution

1
Initiate connection to the perimeter management DMZ
Administrator successfully authenticates to the jump box via MFA at the network boundary.
Direct connections from remote devices into internal secure zones are prohibited by network segmentation policies.
2
Perform posture and access authorization validation on the jump box
The bastion gateway verifies device health and confirms administrative permissions.
Zero trust microsegmentation requires verifying identity and device security posture before allowing transit deeper into the network.
3
Pass through internal stateful firewall microsegmentation controls
Network traffic is permitted through the internal boundary filter specifically targeting the database zone.
Internal firewalls should enforce strict firewall policies allowing DB ports only from the specific IP address of the jump box.
4
Authenticate to the internal target database server
Privileged database administration session begins inside the target subnet.
This is the final destination node requiring database-level credential verification.

Key Concept

Bastion Host Transit & Secure Network Segmentation
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic