Examkin

Question

Difficulty: HardSecure Network Design and Segmentation

A network security team is establishing a zero-trust transit pipeline for remote systems administrators managing a backend database server located in a restricted internal network zone. Place the traffic flow controls and access verification steps in the correct sequential order, from the initial remote connection request to establishing access on the target server.

  1. 1Authenticate to the enterprise perimeter gateway using TLS-encrypted VPN tunnels enforcing multi-factor authentication (MFA).
  2. 2Establish an encrypted administrative session to a hardened bastion host located within a dedicated management DMZ.
  3. 3Traverse an internal Next-Generation Firewall enforcing identity-aware microsegmentation policies and protocol inspection between the management DMZ and the database zone.
  4. 4Authenticate to the backend database server using ephemeral credentials issued via scoped just-in-time access controls.

Answer

The correct sequence for administrative transit into a highly segmented database zone begins at the external perimeter VPN gateway with MFA, proceeds to an isolated bastion host in a management DMZ, transitions through internal microsegmentation firewalls evaluating East-West traffic, and culminates with scoped authentication on the target database server.
Secure network architecture mandates defense-in-depth and strict boundary isolation. The correct order ensures that untrusted external traffic is authenticated at the perimeter VPN, proxied through a bastion host in a management DMZ, filtered through internal microsegmentation firewalls for East-West traffic control, and finally authorized at the destination asset using least-privilege credentials.

Step-by-Step Solution

1
Enforce North-South perimeter security and identity verification
Remote administrator connects via TLS VPN with MFA to gain ingress authorization.
Untrusted incoming connections must be encrypted and authenticated at the edge before any internal subnet exposure occurs.
2
Route administrative traffic to a jump server in the management DMZ
The user initiates an administrative proxy session on a hardened bastion host.
Direct management access from client endpoints to high-value internal assets violates secure segmentation principles. Bastions act as controlled proxies.
3
Enforce internal zone boundaries and microsegmentation filtering
Traffic from the jump server is inspected by internal firewalls filtering East-West network paths.
Internal segmentation controls ensure that even within internal zones, traffic crossing boundaries between management and database segments is explicitly validated.
4
Complete target host authentication in the restricted database segment
The session establishes to the target database server using scoped just-in-time credentials.
Final authentication and granular authorization occur directly at the target resource within the most restrictive network zone.

Key Concept

Bastion Transit Rules and Zone-based Microsegmentation Flow Controls
Estimated Time:2m 0s
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic