Examkin

Question

Difficulty: Very hardSecure Network Design and Segmentation

Match each specialized enterprise network architectural scenario with the network segmentation control or isolation mechanism that best satisfies its security and operational constraints.

  • A legacy industrial control system (ICS) sensor network running end-of-life firmware must transmit batch operational logs out to an external cloud database while strictly blocking any physical or logical inbound transmission paths.Unidirectional Data Diode coupled with physical layer isolation
  • A multi-tenant containerized microservices application requires workload-to-workload identity verification and dynamically enforced intra-host software policy without relying on static IP subnets or perimeter firewall rules.Service Mesh Microsegmentation using eBPF and mutual TLS (mTLS) workload attestation
  • A corporate remote access environment requires external third-party auditors to access internal administrative web consoles without granting their client devices direct IP network routing into the internal corporate subnets.Jump Box / Bastion Host deployed in a DMZ with proxy application-level session brokering
  • A public access Wi-Fi network deployed across corporate branch offices must allow connected client endpoints to reach the default gateway while prohibiting direct Layer 2 peer-to-peer traffic between clients on the same subnet.Private VLANs (PVLANs) configured with isolated ports

Answer

The scenarios correctly match as follows: Legacy ICS telemetry requiring strictly one-way egress matches Unidirectional Data Diode with physical layer isolation; Multi-tenant container microservice isolation requiring identity verification matches Service Mesh Microsegmentation using eBPF and mTLS attestation; Third-party remote access without direct subnet routing matches Jump Box / Bastion Host in a DMZ with proxy brokering; Public branch Wi-Fi client-to-client blocking on a shared subnet matches Private VLANs (PVLANs) configured with isolated ports.
Each segmentation technology directly aligns with the operational constraints of the scenario: physical data diodes guarantee hardware-level one-way transmission for sensitive OT logs; eBPF microsegmentation with mTLS enforces identity-based zero trust for ephemeral container workloads; proxy-based jump boxes isolate internal networks from third-party client routing; and PVLAN isolated ports restrict Layer 2 lateral communications on shared wireless subnets.

Step-by-Step Solution

1
Analyze the legacy ICS requirement for guaranteed one-way outbound data movement with zero inbound connectivity.
Identified physical unidirectional data diode enforcement as the only control preventing backchannel traffic hardware-wide.
Firewalls or software ACLs can be misconfigured or bypassed, whereas data diodes enforce hardware-level physical one-way transmission.
2
Evaluate intra-host container microservices dynamic zero-trust requirements.
Identified service mesh microsegmentation using eBPF and mTLS workload attestation.
Dynamic container environments require identity-based policy enforcement rather than static network IP subnet boundaries.
3
Evaluate third-party remote management without network-level access.
Identified jump box / bastion host with application proxy brokering in a DMZ.
Proxying session protocol payloads avoids routing network packets directly from untrusted client endpoints into corporate subnets.
4
Analyze public Wi-Fi peer-to-peer Layer 2 isolation on the same broadcast domain.
Identified Private VLANs (PVLANs) with isolated ports.
PVLAN isolated ports allow frames to flow only to promiscuous ports (gateway) and drop inter-port client communication.

Key Concept

Selecting network architecture controls based on isolation boundaries (physical, microsegmentation, proxy/bastion, and Layer 2 PVLANs).
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic