Examkin

Question

Difficulty: MediumSecure Network Design and Segmentation

A security engineer is designing network controls for a cloud-hosted e-commerce application processing payment transactions. The architecture requires granular security controls to prevent lateral movement (east-west traffic) between individual cloud workload instances within the cardholder data environment. Which network design strategy best provides granular isolation and controls east-west traffic between individual cloud workloads?

  1. Implementing workload-level microsegmentation using software-defined policies and host-based firewall agents.Answer
  2. B
    Placing all application servers and payment processing services inside a single trusted internal subnet behind a perimeter firewall.
  3. C
    Establishing a physical air gap to decouple cloud application services from cardholder processing instances.
  4. D
    Deploying a passive network intrusion detection system (NIDS) sensor at the subnet gateway to block unauthorized traffic flows.

Answer

Implementing workload-level microsegmentation using software-defined policies and host-based firewall agents.
Microsegmentation isolates workloads granularly down to the host or container level by enforcing security policies directly on workload instances (via software agents or cloud security groups). This approach restricts lateral (east-west) traffic movement regardless of subnet boundaries, directly satisfying the requirement for workload isolation in a cloud environment.

Step-by-Step Solution

1
Analyze the core security requirement.
The scenario requires preventing lateral movement (east-west traffic) between individual workload instances operating in a shared cloud environment.
Traditional perimeter security controls North-South (boundary) traffic, whereas internal instance-to-instance traffic requires granular isolation rules.
2
Evaluate microsegmentation versus traditional network zoning.
Microsegmentation creates micro-perimeters around individual instances using software agents, security groups, or hypervisor/cloud API controls.
This enforces granular access policies at Layer 7 or Layer 4 for east-west traffic directly on workloads.
3
Identify why alternative options are unsuitable.
Single perimeter subnets rely on implicit internal trust; physical air gaps break cloud application connectivity; and passive NIDS sensors detect but do not block traffic.
Only workload-level microsegmentation satisfies both connectivity and preventive east-west containment requirements.

Key Concept

Microsegmentation for East-West Cloud Traffic Isolation
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic