Examkin

Question

Difficulty: Very hardSecure Network Design and Segmentation

A cloud-native financial services company is updating the security architecture of its containerized microservices platform, which handles real-time payment transactions. The security team must limit lateral movement across internal workloads, enforce zero trust principles for internal service communication, and ensure continuous traffic inspection. Which of the following technical controls should the security team implement to achieve this network segmentation design? (Select TWO).

  1. Deploy host-level microsegmentation policies via a service mesh to enforce mutual TLS (mTLS) authentication and application-layer authorization for pod-to-pod communications.Answer
  2. Implement internal layer 7 firewalls and deep packet inspection between internal service tiers to continuously inspect and control East-West network flows.Answer
  3. C
    Establish a traditional single-tier demilitarized zone (DMZ) at the edge firewall to grant implicit trust to all traffic originating from within the private cluster network.
  4. D
    Rely solely on standard network address translation (NAT) combined with stateless IPv4 subnet boundaries to isolate legacy payment services from cloud microservices.

Answer

The security team should deploy service mesh host-level microsegmentation with mutual TLS (mTLS) and implement internal layer 7 firewalls to inspect East-West network traffic continuously.
Implementing service mesh microsegmentation with mutual TLS enforces cryptographically verified identity and application-layer policies between container workloads. Pairwise layer 7 internal firewalling ensures continuous deep packet inspection of East-West traffic, directly stopping unauthorized lateral movement within the cloud environment.

Step-by-Step Solution

1
Analyze the requirements for limiting lateral movement and enforcing zero trust within microservice workloads.
Identified that microservice environments require workload-centric identity and granular East-West traffic controls rather than edge-only defenses.
Containerized workloads share underlying network infrastructure, making traditional perimeter security insufficient.
2
Evaluate microsegmentation and cryptographic access options.
Selected service mesh microsegmentation with mTLS to enforce endpoint identity and application-layer access controls between individual pods.
mTLS guarantees cryptographically validated service identities and encrypts internal traffic.
3
Evaluate traffic inspection mechanisms for internal flows.
Selected internal layer 7 deep packet inspection firewalls for continuous monitoring and filtering of East-West microservice communication.
Layer 7 inspection detects payload threats and protocol anomalies traversing internal segments.

Key Concept

Microsegmentation and East-West Traffic Protection in Zero Trust Architecture
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic