Question

Difficulty: MediumSecure Network Design and Segmentation

A network security architect is reviewing the network segmentation design for an enterprise financial organization. The enterprise must implement appropriate isolation controls across diverse operational environments to satisfy regulatory compliance and mitigate lateral movement risks. Match each network design or segmentation technique on the left with its corresponding enterprise architectural requirement on the right.

  • MicrosegmentationGranular enforcement of host-level policies to control East-West traffic between individual containerized workload instances.
  • Air GapComplete physical separation of highly critical systems from all external networks to prevent any network-based vector.
  • Demilitarized Zone (DMZ)Screened perimeter subnet designed to host public-facing API services while insulating internal database servers.
  • Jump Box / Bastion HostCentralized, hardened gateway used to authenticate and audit administrator access into secure management zones.

Answer

Microsegmentation connects with granular control of East-West workload traffic. Air Gap connects with complete physical network separation. Demilitarized Zone (DMZ) connects with hosting public-facing services away from internal networks. Jump Box connects with secure, audited administrator gateway access.
Each segmentation technique aligns directly with its primary defensive boundary design: Microsegmentation enforces host-to-host micro-boundaries (East-West); Air Gap enforces total physical isolation; DMZ enforces perimeter service separation (North-South); and a Jump Box enforces secure, centralized administrative entry into secure segments.

Step-by-Step Solution

1
Analyze Microsegmentation requirements
Identified as logical host/workload separation controlling East-West traffic
Microsegmentation isolates workloads at the hypervisor or OS layer within cloud/virtual environments.
2
Analyze Air Gap requirements
Identified as complete physical separation with zero network connectivity
Air-gapping ensures critical infrastructure cannot be targeted via network communication paths.
3
Analyze DMZ requirements
Identified as a screened boundary network for public services
DMZs prevent direct inbound access from public internet clients into internal core segments.
4
Analyze Jump Box requirements
Identified as a hardened management intermediary for privilege access
Bastion hosts centralize authentication, session recording, and access control for administrative tasks.

Key Concept

Network Segmentation and Isolation Controls
Rate this question