Examkin

Question

Difficulty: HardSecure Network Design and Segmentation

An organization is updating its cloud-native architecture for a healthcare portal processing Sensitive Personal Health Information (PHI). The security architecture team must enforce strict isolation between individual microservices to prevent lateral movement, continuously authenticate every service-to-service communication path, and inspect East-West traffic without relying solely on perimeter boundary firewalls. Which of the following network architecture strategies best satisfies these requirements?

  1. Implement microsegmentation using a Service Mesh architecture enforcing mutual TLS (mTLS) and dynamic identity-based network policies.Answer
  2. B
    Place all microservices within a single internal trusted network zone protected by a high-throughput perimeter Next-Generation Firewall (NGFW).
  3. C
    Establish a physically air-gapped network segment for all application nodes while routing inbound API calls through a jump box.
  4. D
    Deploy a network intrusion prevention system (NIPS) in passive out-of-band mode at the core router to automatically block malicious East-West traffic.

Answer

Implementing microsegmentation using a Service Mesh architecture enforcing mutual TLS (mTLS) and dynamic identity-based network policies.
Microsegmentation divides cloud environments into distinct security segments down to the individual workload level. Using a Service Mesh with mTLS ensures cryptographic identity verification and encrypted session enforcement for all East-West microservice traffic, aligning with Zero Trust secure network design principles.

Step-by-Step Solution

1
Analyze the architectural requirements
Identified the need for granular service-to-service isolation (East-West control), continuous identity verification, and prevention of lateral movement within cloud microservices.
Traditional perimeter firewalls cannot inspect microservice-to-microservice traffic efficiently or enforce identity-based access control.
2
Evaluate segmentation strategies for cloud-native microservices
Microsegmentation using a Service Mesh decouples security policies from network topology, enforcing cryptographic identity via mTLS and zero trust access rules at layer 7.
This guarantees granular isolation without relying on implicit perimeter trust.
3
Differentiate from incorrect legacy architecture controls
Eliminated broad VLAN perimeter placement, air-gapping operational microservices, and passive detective sensors.
Perimeter reliance allows unchecked lateral movement, air gaps break cloud microservice functionality, and passive NIPS cannot actively block inline traffic.

Key Concept

Microsegmentation and Zero Trust Architecture in Network Design
Estimated Time:2m 0s
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic