A security architect is updating the network architecture for an organization that hosts public-facing web services, internal corporate workstations, and backend databases containing confidential payment data. Which of the following network segmentation controls and design practices should the architect implement to secure East-West traffic and isolate these environments? (Select TWO.)
- Place public-facing web servers in a screened subnet (DMZ) to prevent external untrusted traffic from directly accessing backend database servers.Answer
- Implement microsegmentation using internal next-generation firewalls to continuously filter and restrict traffic moving laterally between server zones.Answer
- CRely on an edge perimeter firewall to automatically trust and grant unrestricted access to all internal subnets once a user passes initial perimeter authentication.
- DCombine guest wireless users and database servers within the same default virtual local area network (VLAN) to minimize routing complexity.
Answer
The architect should deploy public web servers in a screened subnet (DMZ) to prevent direct inbound database connectivity, and implement microsegmentation via internal next-generation firewalls to inspect lateral East-West traffic.
Establishing a screened subnet (DMZ) ensures external web traffic is isolated from internal databases, while microsegmentation restricts lateral movement between internal workload zones by applying policy checks on East-West communications.
Step-by-Step Solution
Key Concept
Network Segmentation and Microsegmentation