Examkin

Question

Difficulty: MediumSecure Network Design and Segmentation

A network security architect is establishing ingress and zone traversal inspection controls for a public-facing e-commerce platform. The architecture requires multi-tiered network segmentation to isolate external web traffic from sensitive internal backend databases. In what order should inbound network traffic pass through these security controls and network zones, starting from initial external ingress to the final destination in the isolated database zone?

  1. 1Perimeter Edge Router with Anti-DDoS Filtering
  2. 2Screened Subnet (DMZ) Web Application Firewall (WAF)
  3. 3Internal Next-Generation Firewall (NGFW) Enforcement Boundary
  4. 4Database Zone Microsegmentation Gateway

Answer

The correct sequence for inbound traffic traversal begins at the Perimeter Edge Router with Anti-DDoS Filtering, moves to the Screened Subnet (DMZ) Web Application Firewall (WAF), passes through the Internal Next-Generation Firewall (NGFW) Enforcement Boundary, and completes at the Database Zone Microsegmentation Gateway.
In a defense-in-depth architecture, external traffic must be inspected in progressive layers of increasing security. Traffic first hits the perimeter edge router for high-volume network filtering, enters the Screened Subnet (DMZ) WAF for web application inspection, crosses the internal firewall boundary to reach application services, and finally passes through microsegmentation controls protecting the high-value database zone.

Step-by-Step Solution

1
Filter network-layer threats at the external entry point
Volumetric DDoS traffic and spoofed IP packets are blocked at the perimeter edge router before reaching internal services.
Perimeter routers protect edge infrastructure from being overwhelmed by raw network traffic.
2
Perform application-layer payload inspection in the public-facing DMZ
Web traffic is decrypted and inspected by the Web Application Firewall (WAF) in the screened subnet for web vulnerabilities such as SQL injection or XSS.
Public-facing web services must terminate in a DMZ so untrusted external sessions never reach internal networks directly.
3
Enforce network boundary controls between DMZ and internal application servers
The internal NGFW validates stateful traffic rules allowing only authorized web application requests into the internal application tier.
An internal boundary control prevents compromised DMZ hosts from directly traversing into sensitive enterprise network segments.
4
Apply microsegmentation policy at the high-security database tier
The microsegmentation gateway isolates database servers and ensures only approved application server nodes can communicate using specific database ports.
Microsegmentation enforces zero trust granularity around high-value backend data assets.

Key Concept

Multi-tier network segmentation and defense-in-depth traffic flow inspection
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic