Examkin

Question

Difficulty: Very hardSecure Network Design and Segmentation

A global transport logistics enterprise operates edge processing nodes in regional data centers to handle real-time vehicle telematics. High-frequency microservices exchange East-West traffic with strict low-latency requirements, while aggregate telematics summaries are transmitted North-South to the central corporate cloud. A security assessment revealed that external vendor technicians connect to administrative interfaces using direct subnets, creating significant risk of lateral movement across internal services. Which of the following network architecture designs best secures the edge processing environment while preserving performance and administrative isolation?

  1. Implement software-defined microsegmentation using an eBPF service mesh for internal East-West microservice traffic, paired with a dedicated jump server inside an isolated management DMZ for external technician administrative access.Answer
  2. B
    Deploy a single high-throughput perimeter Next-Generation Firewall (NGFW) to filter all boundary traffic, leaving internal VLAN traffic uninspected to minimize microservice communication latency.
  3. C
    Enforce a complete physical air-gap between the edge processing nodes and the corporate WAN, requiring scheduled manual batch updates for aggregate telemetry reporting.
  4. D
    Classify vendor management subnets as compensating physical security controls and configure private VLANs (PVLANs) across all edge nodes without inspecting application-layer microservice traffic.

Answer

The optimal design uses software-defined microsegmentation (via an eBPF service mesh) for East-West microservice traffic and an isolated management DMZ jump server for third-party administrative access.
Combining eBPF-based service mesh microsegmentation with a management DMZ jump server enforces Zero Trust principles. Microsegmentation secures East-West microservice communication with sub-millisecond overhead, while the jump box restricts external vendor access to a monitored, single entry point, preventing lateral movement into internal telemetry networks.

Step-by-Step Solution

1
Analyze traffic vectors and operational requirements.
Identified two primary traffic paths: East-West microservice telematics processing (demanding minimal latency) and North-South reporting/administrative access.
Different traffic types require tailored security controls to avoid latency bottlenecks while maintaining isolation.
2
Evaluate internal East-West control mechanisms.
Selected eBPF service mesh microsegmentation to enforce identity-based access policies directly at the host/kernel level with minimal overhead.
Traditional network firewalls introduce latency and lack container/microservice visibility, whereas microsegmentation prevents lateral movement inside the network.
3
Select administrative remote access controls.
Routed third-party technician access through a centralized jump box (bastion host) within a dedicated management DMZ.
Direct subnet access by vendors presents high risk; a jump server ensures strict authentication, session logging, and isolation from critical microservice networks.

Key Concept

Secure Network Design and Microsegmentation
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic