Examkin

Question

Difficulty: HardSecure Network Design and Segmentation

An enterprise financial organization is redesigning its network architecture for a cloud-hosted payment gateway platform. While perimeter Next-Generation Firewalls (NGFW) currently inspect all North-South ingress traffic from external clients, recent audit logs revealed that compromised web application nodes in the public presentation subnet attempted unauthorized lateral movement (East-West traffic) to internal database clusters within the same virtual private network. The security team requires a design that enforces granular, application-centric access controls between internal workloads without requiring major subnet re-addressing or causing latency bottlenecks associated with hairpinning internal traffic through a central hardware appliance. Which of the following architectural strategies best satisfies these requirements?

  1. Deploy a software-defined microsegmentation architecture utilizing service mesh network policies and mutual TLS (mTLS) between application workload endpoints.Answer
  2. B
    Route all internal inter-subnet communications through the existing perimeter NGFW by modifying default gateway dynamic routing tables.
  3. C
    Consolidate all database clusters into a single screen subnet (DMZ) protected exclusively by stateful edge router ACLs.
  4. D
    Implement a physical data diode between the web application presentation tier and the internal database storage tier.

Answer

Deploying a software-defined microsegmentation architecture utilizing service mesh network policies and mutual TLS (mTLS) between application workload endpoints is the optimal solution.
The correct strategy involves software-defined microsegmentation paired with a service mesh enforcing mTLS. Microsegmentation divides networks into granular security zones down to individual workload instances. By applying policy at the hypervisor or container sidecar level, East-West traffic between web nodes and database clusters is strictly controlled and encrypted regardless of underlying IP subnet structures, eliminating latency from traffic hairpinning through edge firewalls.

Step-by-Step Solution

1
Analyze the architectural challenge and network traffic vectors.
Identified unauthorized lateral movement (East-West traffic) between compromised web containers and database workloads located within internal network boundaries.
Traditional perimeter firewalls only filter North-South traffic crossing the network boundary and cannot effectively isolate workloads residing inside the same broadcast domain or subnet.
2
Evaluate constraint parameters.
The solution must avoid network hairpinning, IP re-addressing overhead, and performance bottlenecks.
Routing intra-datacenter microservice traffic through a centralized hardware appliance causes latency degradation and scalable failure points.
3
Select the appropriate segmentation model.
Software-defined microsegmentation via service mesh / host network policies enforces identity-based zero-trust isolation directly at the software workload layer.
Microsegmentation isolates individual workloads down to the single container or VM level regardless of physical network topology or shared subnets.

Key Concept

Microsegmentation and East-West Traffic Isolation
Estimated Time:2m 0s
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic