A security architect is updating the enterprise security baseline for several subnets and workload environments. Match each network design requirement to the most appropriate architecture technique or isolation mechanism.
- Completely detaching sensitive legacy industrial control devices from all physical and wireless network connectivityAir-gapping
- Restricting lateral East-West traffic flow between virtual machine workloads operating on the same hypervisor hostMicrosegmentation
- Placing publicly accessible web application servers in a network boundary separated from internal database serversDemilitarized Zone (DMZ)
- Establishing a single, heavily monitored host through which system administrators must authenticate to access remote secure zonesJump box / Bastion host
Answer
Complete network detachment corresponds to Air-gapping; Restricting lateral virtual machine traffic corresponds to Microsegmentation; Separating public web servers from core databases corresponds to Demilitarized Zone (DMZ); Enforcing a single monitored administrative gateway corresponds to Jump box / Bastion host.
Air-gapping ensures absolute isolation from external networks; microsegmentation applies workload-level traffic filtering to limit lateral movement within subnets; a DMZ segregates public-facing resources from internal networks; and a jump box serves as a secured gateway for privileged administrative sessions.
Step-by-Step Solution
Key Concept
Network Segmentation Archetypes and Traffic Isolation Controls