Examkin

Question

Difficulty: MediumSecure Network Design and Segmentation

A financial services company recently migrated its online portal to a cloud-based containerized microservices architecture. Security telemetry indicates that an attacker successfully compromised a public-facing API gateway container and attempted lateral movement to internal microservices residing on the same Virtual Private Cloud (VPC) subnet. The security team must prevent unauthorized lateral (East-West) communication between workloads within the same subnet without changing the existing IP addressing scheme. Which of the following secure network design controls should the security architect implement?

  1. Implement host-based microsegmentation using software-defined network policies enforcement.Answer
  2. B
    Deploy a centralized perimeter stateful firewall at the VPC edge gateway to inspect incoming traffic.
  3. C
    Aggregate all microservice containers into a single flat VLAN to simplify broadcast domain management.
  4. D
    Install an out-of-band Network Intrusion Detection System (NIDS) sensor on the subnet switch port.

Answer

Implement host-based microsegmentation using software-defined network policies enforcement.
Microsegmentation uses software-defined policies directly on workloads or container hosts to enforce access controls granularly. This isolates individual workloads and restricts East-West traffic flows between container instances operating on the same physical or virtual subnet.

Step-by-Step Solution

1
Analyze the security requirement and constraint.
The requirement is to isolate intra-subnet (East-West) traffic between container workloads without altering IP subnet configurations.
Standard network layer segmentation (VLANs/subnets) operates at Layer 3/Layer 2 boundary, whereas microservices within the same subnet communicate laterally unless host/hypervisor policy enforcement is applied.
2
Evaluate potential control mechanisms against Zero Trust network architecture principles.
Host-based microsegmentation provides explicit workload-to-workload policy enforcement at Layer 7/application layer or hypervisor/vSwitch level.
Microsegmentation creates micro-perimeters around individual workloads, enforcing least-privilege traffic rules regardless of network physical topology.

Key Concept

Microsegmentation and East-West Traffic Isolation
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic