Examkin

Question

Difficulty: MediumSecure Network Design and Segmentation

A enterprise network security architect is reviewing the organization's network segmentation model across physical, virtual, and industrial environments. Match each network segmentation approach to the business and architectural requirement it best addresses.

  • Air GapPhysically isolating safety-critical Operational Technology (OT) systems from all external network connectivity.
  • MicrosegmentationApplying granular software-defined policy enforcement to restrict lateral East-West traffic between individual workload containers.
  • Screened Subnet (DMZ)Hosting public-accessible services to isolate external internet traffic from the private internal corporate network.
  • Jump Box (Bastion Host)Providing a secure, audited single entry point for administrator access to highly sensitive management networks.

Answer

Air Gap matches physical isolation of OT systems; Microsegmentation matches granular software-defined East-West traffic control between workloads; Screened Subnet matches hosting public-facing services separated from private networks; Jump Box matches providing a single audited administrative transit point into sensitive zones.
Air gapping ensures physical isolation for critical OT systems. Microsegmentation enforces policy-based isolation for East-West cloud workload traffic. A screened subnet isolates internet-accessible assets from internal networks, and a jump box securely bridges administrative access into high-security zones.

Step-by-Step Solution

1
Analyze the operational requirements for high-security OT environments requiring total network disconnect.
Identify Air Gap as the physical isolation technique suited for SCADA/ICS safety systems.
Air gapping completely eliminates network vectors by removing physical connection paths.
2
Analyze requirements for preventing lateral movement within modern data center workload tiers.
Identify Microsegmentation as the appropriate control for granular East-West traffic restriction.
Microsegmentation uses software-defined policies to isolate individual container workloads regardless of physical topology.
3
Analyze requirements for exposing public services securely.
Identify Screened Subnet (DMZ) as the perimeter boundary control.
Screened subnets buffer public traffic between internal and external firewalls.
4
Analyze administrative security access requirements for sensitive zones.
Identify Jump Box (Bastion Host) as the controlled management transit server.
Jump boxes enforce centralized authentication, access controls, and logging for administrative sessions.

Key Concept

Secure Network Segmentation Archetypes and Traffic Control Controls
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic