Examkin

Question

Difficulty: HardSecure Network Design and Segmentation

An enterprise security architect is updating the organization's network architecture to mitigate lateral threat movement, secure legacy components, and control administrative access across enterprise zones. Match each network design or segmentation technique on the left with its corresponding architectural application on the right.

  • East-West Traffic MicrosegmentationEnforces host-level firewall policies to restrict lateral movement between database servers within the same subnet.
  • Screened Subnet (DMZ) with Dual-Homed FirewallsTerminates internet-facing connections in a perimeter zone while preventing direct traffic flow to internal assets.
  • Air-Gapped Out-of-Band Management NetworkIsolates critical physical systems by eliminating routed network connections to external networks.
  • Software-Defined Perimeter (SDP) GatewayDynamically provisions authenticated user access to application endpoints while hiding infrastructure behind a dark cloud.

Answer

East-West Traffic Microsegmentation maps to enforcing host-level firewall policies between databases in the same subnet; Screened Subnet with Dual-Homed Firewalls maps to terminating internet-facing connections in a perimeter zone; Air-Gapped Out-of-Band Management Network maps to isolating systems without routed external connectivity; Software-Defined Perimeter Gateway maps to dynamically provisioning authenticated access while hiding infrastructure.
Each technique addresses a specific network segmentation boundary requirement: East-West microsegmentation controls internal host-to-host traffic within the same subnet; screened subnets isolate public services at the network perimeter; air-gaps eliminate packet routing paths entirely; and SDP gateways conceal infrastructure behind identity-verified tunnels.

Step-by-Step Solution

1
Analyze East-West traffic flow controls
Identify microsegmentation as the technique that enforces policies on lateral movement between workloads in the same segment.
Traditional perimeter firewalls monitor North-South traffic, whereas microsegmentation monitors East-West internal traffic.
2
Analyze perimeter untrusted access controls
Map screened subnets (DMZ) with dual firewalls to untrusted external perimeter terminations.
Screened subnets provide buffer zones between external networks and protected internal networks.
3
Analyze strict physical and operational isolation requirements
Map air-gapping to systems that require total absence of external packet routing.
Air-gapping guarantees physical or strict logical disconnect from un-trusted networks.
4
Analyze Zero Trust network access mechanisms
Map Software-Defined Perimeter (SDP) to dynamic, identity-based cloaking of services.
SDP creates individual encrypted tunnels to authorized applications while keeping network infrastructure concealed.

Key Concept

Network Segmentation Archetypes and Traffic Control Architecture
Estimated Time:2m 0s
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic