A security architect is reviewing the access control path for remote administrators connecting from an untrusted management subnet to a high-security internal database zone holding regulated financial records. To enforce defense-in-depth and zero-trust principles, traffic must traverse multiple inspection boundaries and transit controls in a precise order. Sequence the security controls and transit points in the correct order that administrative network traffic must navigate from the originating management workstation to the target database server.
- 1Administrative traffic initiates from the management subnet and passes through a perimeter firewall performing stateful ingress rule filtering.
- 2The administrator authenticates and establishes a multi-factor encrypted management session on a Jump Server (Bastion Host) located in the Management DMZ.
- 3Outbound traffic from the Jump Server is evaluated by an internal Next-Generation Firewall (NGFW) enforcing East-West microsegmentation policies and protocol inspection.
- 4Traffic arrives at the microsegmented database VLAN switch port enforced by Private VLAN (PVLAN) isolation rules and host-based firewall policy.
Answer
The correct sequence starts at the perimeter firewall filtering incoming management traffic, proceeds to session establishment on the Jump Server in the DMZ, moves through the internal NGFW performing East-West inspection, and finishes at the microsegmented target switch port and host boundary.
In secure network architecture, traffic moving from an outer management zone to an inner critical zone follows a strict transit path: 1) Initial perimeter firewall filtering, 2) Intermediate bastion/jump box session proxying in a DMZ, 3) Internal NGFW microsegmentation and East-West inspection, and 4) Final Layer 2 PVLAN and host-level enforcement.
Step-by-Step Solution
Key Concept
Zone Traversal and Network Segmentation Order