Examkin

Question

Difficulty: Very hardSecure Network Design and Segmentation

An enterprise security architect is aligning network isolation mechanisms with specific high-assurance business requirements across diverse deployment environments. Match each network segmentation approach on the left with its defining architectural implementation requirement on the right.

  • Software-Defined Microsegmentation with Service MeshEnforces fine-grained East-West traffic isolation between containerized microservices based on cryptographic workload identities rather than static IP subnets.
  • Unidirectional Security Gateway (Data Diode)Allows high-assurance outbound telemetry streaming from sensitive operational zones while physically prohibiting any inbound signal propagation.
  • Air-Gapped Network TopologyCompletely detaches high-security offline root certificate authorities from routable networks, preventing network-level intrusion and necessitating physical access.
  • Screened Subnet (DMZ) ArchitectureTerminates incoming North-South public traffic in an isolated perimeter buffer zone to inspect requests before proxying connections into internal application tiers.

Answer

Software-Defined Microsegmentation pairs with enforcing East-West workload identity traffic control. Unidirectional Security Gateway pairs with physically blocking inbound signals while streaming outbound telemetry. Air-Gapped Network Topology pairs with completely detaching offline root CAs from networks. Screened Subnet Architecture pairs with terminating incoming North-South Internet traffic in a perimeter buffer zone.
Each isolation mechanism corresponds directly to its architectural domain: Software-Defined Microsegmentation governs dynamic East-West service traffic using workload identity; Unidirectional Security Gateways (data diodes) enforce physical one-way transmission for telemetry; Air-Gapping provides complete physical and logical isolation for offline assets like root CAs; and Screened Subnets (DMZs) isolate perimeter North-South public access points.

Step-by-Step Solution

1
Analyze workload identity vs. network subnetting controls for microservice architectures.
Identify that Software-Defined Microsegmentation with a Service Mesh manages East-West traffic based on service identities rather than IP addresses.
Containerized workloads require dynamic granular policies that transcend static IP boundaries.
2
Evaluate strict physical traffic direction enforcement mechanisms for telemetry export.
Identify that a Data Diode (Unidirectional Gateway) physically restricts data flow to outbound-only transmissions.
Hardware-enforced optical paths prevent bi-directional handshake capability, protecting critical infrastructure from inbound attacks.
3
Determine the highest level of isolation for offline infrastructure assets like root CAs.
Select Air-Gapped Network Topology as the mechanism ensuring total physical and logical network separation.
Root CAs must remain immune to remote exploitation by eliminating network interfaces entirely.
4
Examine perimeter inspection zone characteristics for untrusted public traffic.
Match Screened Subnet (DMZ) Architecture with North-South public traffic termination and proxy inspection.
DMZs act as intermediate buffers preventing direct internet access to sensitive internal application tiers.

Key Concept

Selecting and matching network segmentation archetypes (DMZ, microsegmentation, air-gapping, data diode) to specific isolation and traffic flow requirements.
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic