Examkin

Question

Difficulty: Very hardSecure Network Design and Segmentation

An enterprise security architect is designing a network architecture for a hybrid micro-datacenter that hosts PCI-DSS scoped payment processing workloads alongside unmanaged IoT environmental sensors on shared physical network switches. The design must prevent direct Layer 2 or Layer 3 lateral movement between any endpoints located within the same IP subnet, without requiring dedicated physical switches or administrative overhead from managing hundreds of individual VLAN subnets and IP pools. Which of the following secure network design strategies best meets these requirements?

  1. Configure Private VLANs (PVLANs) on the access switches using isolated secondary VLANs to restrict port-to-port communication within the shared subnet.Answer
  2. B
    Implement standard 802.1Q VLAN tagging with subinterfaces on a router to apply ingress access control lists (ACLs) to inter-VLAN traffic.
  3. C
    Deploy an enterprise next-generation firewall (NGFW) at the network perimeter to inspect incoming North-South connection attempts to the micro-datacenter.
  4. D
    Position a network intrusion prevention system (NIPS) in passive tap mode to detect and terminate unauthorized Address Resolution Protocol (ARP) requests.

Answer

Configuring Private VLANs (PVLANs) using isolated secondary VLANs provides Layer 2 microsegmentation within a single IP subnet, blocking port-to-port East-West traffic without allocating extra IP subnets or physical switch hardware.
Private VLANs (PVLANs) extend standard VLAN capabilities by subdividing a single broadcast domain into secondary isolation zones. Endpoints connected to isolated ports can only communicate with designated promiscuous ports (such as the default gateway router), preventing lateral movement and frame forwarding between peers on the same subnet without allocating new IP subnets.

Step-by-Step Solution

1
Analyze the scenario constraints and security objectives.
Identified the need to block lateral movement (East-West traffic) between endpoints residing on the exact same IP subnet and physical switch without creating multiple subnets or buying dedicated hardware.
Standard IP routing controls operate at Layer 3 between subnets, whereas endpoints on the same subnet communicate directly at Layer 2 through switch MAC address tables.
2
Evaluate network isolation technologies against Layer 2 constraints.
Private VLANs (PVLANs) split a primary VLAN into secondary sub-domains (isolated, community, promiscuous). Isolated ports cannot communicate with any other isolated or community port on the same switch.
PVLAN technology enforces Layer 2 port isolation while preserving a single IP subnet boundary, avoiding routing complexity and extra VLAN/subnet overhead.
3
Eliminate ineffective perimeter or sub-interface architecture proposals.
Options relying on standard 802.1Q inter-VLAN routing, perimeter firewalls, or passive NIPS taps fail to restrict intra-subnet Layer 2 frame forwarding.
Traffic between endpoints in the same subnet never traverses a router or perimeter firewall unless Layer 2 port isolation is enforced at the access layer.

Key Concept

Private VLAN (PVLAN) Microsegmentation
Estimated Time:3m 0s
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic