Examkin

Question

Difficulty: HardSecure Network Design and Segmentation

A financial services organization operates a microservices-based payment engine within a container orchestration cluster. Public API proxies, payment verification services, and sensitive database connectors execute across shared worker nodes. To mitigate lateral movement risks between workloads running on identical physical hosts while satisfying strict audit compliance, which of the following network architecture controls should the security team implement?

  1. Microsegmentation using network policies and software-defined granular controls to inspect and filter east-west container traffic.Answer
  2. B
    Physical VLAN segmentation configured at top-of-rack switches to separate worker node infrastructure into distinct network zones.
  3. C
    A traditional perimeter firewall deployed at the ingress router to filter all incoming north-south network requests.
  4. D
    An intrusion detection system installed at the core network layer to issue alerts upon detecting unauthorized pod-to-pod communication.

Answer

Microsegmentation using network policies and software-defined granular controls to inspect and filter east-west container traffic.
Microsegmentation uses software-defined network (SDN) rules and container network policy plugins to enforce granular isolation at the individual workload layer (Layer 7 / host network layer). This enables strict control over east-west traffic between microservices, preventing unauthorized lateral movement even when services execute on the exact same worker host node.

Step-by-Step Solution

1
Analyze the architectural requirements and environment constraints.
Identified a container cluster environment sharing physical worker nodes with a requirement to prevent lateral movement between pods on the same host.
Containerized workloads sharing worker node operating system kernels require logical isolation controls below the physical network switch layer.
2
Evaluate traffic patterns requiring control.
Recognized that inter-service communication within a host cluster represents internal east-west network traffic.
Standard perimeter firewalls only filter north-south incoming and outgoing boundary traffic.
3
Select the appropriate network isolation security control.
Determined that microsegmentation utilizing software-defined networking rules enforces pod-level access controls.
Microsegmentation creates fine-grained security zones at the workload level, isolating containerized services regardless of physical placement.

Key Concept

Microsegmentation for East-West Container Traffic Isolation
Estimated Time:2m 0s
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic