Examkin

Question

Difficulty: MediumSecure Network Design and Segmentation

An enterprise security architect is designing network isolation controls for a corporate software development environment. The architecture must prevent lateral movement between developer workstations on the same local subnet while restricting direct administrative connections from developer machines to automated build servers. Which of the following network design strategies should the architect implement to achieve these requirements? (Select TWO.)

  1. Configure Private VLANs (PVLANs) with isolated ports for the developer workstation subnet.Answer
  2. Deploy a bastion host within a dedicated transit zone to mediate management connections to the build servers.Answer
  3. C
    Establish a physical air gap between developer workstations and internal build automation servers.
  4. D
    Rely on the external perimeter firewall to inspect and implicitly trust all East-West traffic within the internal subnet.

Answer

The architect should configure Private VLANs (PVLANs) with isolated ports on the developer workstation subnet and deploy a bastion host within a dedicated transit zone to control access to build servers.
Private VLANs (PVLANs) effectively isolate endpoints on the same subnet at Layer 2 to prevent lateral movement, while a bastion host in a transit zone ensures all administrative access to build systems is authenticated, logged, and proxied rather than directly exposed.

Step-by-Step Solution

1
Analyze the lateral isolation requirement for developer workstations on the same subnet.
Determine that Layer 2 isolation via Private VLANs (PVLANs) prevents workstation-to-workstation (East-West) communication within a shared IP subnet.
PVLAN isolated ports restrict traffic so endpoints can only communicate with designated promiscuous ports (like gateways), mitigating lateral attack spread.
2
Analyze the access control requirement for administrative access to build servers.
Select a jump server/bastion host deployment within a DMZ or transit zone.
Bastion hosts mandate multi-factor authentication, logging, and strict proxying, preventing direct exposure of critical build infrastructure to general endpoint subnets.

Key Concept

Secure Network Segmentation and Lateral Movement Control
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic