A network security architect is reviewing the network segmentation design for an enterprise financial organization. The enterprise must implement appropriate isolation controls across diverse operational environments to satisfy regulatory compliance and mitigate lateral movement risks. Match each network design or segmentation technique on the left with its corresponding enterprise architectural requirement on the right.
- MicrosegmentationGranular enforcement of host-level policies to control East-West traffic between individual containerized workload instances.
- Air GapComplete physical separation of highly critical systems from all external networks to prevent any network-based vector.
- Demilitarized Zone (DMZ)Screened perimeter subnet designed to host public-facing API services while insulating internal database servers.
- Jump Box / Bastion HostCentralized, hardened gateway used to authenticate and audit administrator access into secure management zones.
Answer
Microsegmentation connects with granular control of East-West workload traffic. Air Gap connects with complete physical network separation. Demilitarized Zone (DMZ) connects with hosting public-facing services away from internal networks. Jump Box connects with secure, audited administrator gateway access.
Each segmentation technique aligns directly with its primary defensive boundary design: Microsegmentation enforces host-to-host micro-boundaries (East-West); Air Gap enforces total physical isolation; DMZ enforces perimeter service separation (North-South); and a Jump Box enforces secure, centralized administrative entry into secure segments.
Step-by-Step Solution
Key Concept
Network Segmentation and Isolation Controls