Examkin

Question

Difficulty: MediumSecure Network Design and Segmentation

A security architect for an enterprise organization is designing network isolation controls across various operational environments. Match each security design requirement on the left to the network segmentation mechanism on the right that best satisfies it.

  • Isolating legacy industrial control hardware that requires complete protection from remote network vectors and has no requirement for network communication.Air gap
  • Restricting East-West network traffic between individual containerized microservices hosted within the same virtualized cluster.Microsegmentation
  • Providing a hardened, audited entry point for administrators to establish remote management sessions into internal infrastructure.Jump box / Bastion host
  • Placing public-facing application servers in a perimeter zone to prevent direct network traversal to internal corporate databases.Demilitarized Zone (DMZ)

Answer

Legacy hardware isolation matches Air gap; Container microservices restriction matches Microsegmentation; Administrative entry point matches Jump box / Bastion host; Public-facing server perimeter matches Demilitarized Zone (DMZ).
Each requirement directly aligns with standard network segmentation mechanisms: Air gap provides total network detachment for highly sensitive/legacy hardware; Microsegmentation provides granular control over East-West traffic between container workloads; Jump boxes act as secure gateways for admin sessions; DMZs buffer public-facing web servers from private internal database zones.

Step-by-Step Solution

1
Analyze the security requirement for complete isolation without external network connectivity.
Identify that an Air gap removes all physical or logical network connections, which is required for vulnerable or isolated legacy hardware.
Air gapping eliminates remote network attack vectors entirely.
2
Evaluate intra-cluster granular isolation needs between virtualized workloads.
Identify Microsegmentation as the control that governs lateral (East-West) traffic between virtual machines or containerized services.
Traditional perimeter firewalls cannot inspect or block traffic between adjacent workloads inside the same host cluster.
3
Determine the control required for secure admin access into sensitive internal segments.
Match Jump box / Bastion host as the hardened proxy system through which administrative traffic is funneled and monitored.
Jump hosts prevent direct remote access connections from reaching internal production environments.
4
Determine the control for isolating public services from internal databases.
Match Demilitarized Zone (DMZ) as the perimeter architecture isolating public web servers from internal data stores.
A DMZ restricts ingress to untrusted internet traffic while enforcing strict inspection on traffic attempting to reach internal zones.

Key Concept

Network Segmentation Mechanisms and Architecture
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic