Examkin

Soru

Zorluk: Çok zorSecure Network Design and Segmentation

A network security architect is designing an ingress traffic transit flow for an enterprise application processing sensitive financial data. External client traffic must traverse multiple physical and logical security zones to interact with the backend database while enforcing strict North-South and East-West control boundaries. Arrange the following network security architecture traversal steps in the correct sequential order from the initial external inbound packet arrival to the final payload processing at the database host.

  1. 1Traffic arrives at the edge perimeter router and undergoes initial stateless packet filtering and DDoS mitigation.
  2. 2Packets pass through an external Web Application Firewall (WAF) in the screened subnet (DMZ) for Layer 7 protocol inspection and TLS termination.
  3. 3Inspected traffic traverses an internal Next-Generation Firewall (NGFW) enforcing North-South access control lists (ACLs) to enter the application tier.
  4. 4Microsegmentation policies on the virtual switch restrict East-West communication, allowing only verified application pods to initiate connections to the database gateway.
  5. 5Traffic passes through a database proxy jump host enforcing strict identity-based database authentication before hitting the isolated database VLAN.

Cevap

The correct sequence of network security traversal from untrusted ingress to the isolated database host is: 1) Edge perimeter router stateless packet filtering/DDoS mitigation, 2) DMZ Web Application Firewall (WAF) Layer 7 inspection and TLS termination, 3) Internal NGFW North-South enforcement into the application tier, 4) Virtual switch microsegmentation governing East-West lateral traffic, and 5) Database proxy/jump gateway identity enforcement entering the isolated database zone.
The correct sequence reflects a defense-in-depth network architecture. Untrusted internet traffic is first filtered statelessly at the edge perimeter router to mitigate volumetric attacks. Next, it reaches the screened subnet (DMZ) where a Web Application Firewall decrypts and inspects application layer traffic. Valid requests then cross the internal North-South firewall boundary into the internal application tier. Within this tier, microsegmentation policies govern East-West lateral communications between microservices. Finally, traffic bound for the sensitive database must authenticate through a database proxy gateway before accessing the isolated backend database VLAN.

Adım Adım Çözüm

1
Filter perimeter traffic
Untrusted network traffic is cleaned of volumetric anomalies and malformed packets at the outermost edge.
Perimeter routers block malformed packets and mitigate volumetric threats before deep packet inspection components are overwhelmed.
2
Inspect application payload in DMZ
Public HTTP/HTTPS traffic is terminated, decrypted, and evaluated against Web Application Firewall rules.
Screened subnets (DMZs) isolate public-facing ingress points from internal network infrastructure.
3
Enforce North-South zone boundaries
Approved requests transition from the DMZ to the internal application subnet via an internal NGFW.
Internal firewalls prevent compromised DMZ hosts from directly accessing internal corporate assets without strict layer 3/4 and layer 7 policies.
4
Apply microsegmentation to East-West traffic
Application container and virtual machine lateral traffic is restricted to explicitly allowed service channels.
Microsegmentation enforces Zero Trust within the application tier, mitigating lateral movement if an application node is breached.
5
Authenticate and proxy database requests into the isolated subnet
Queries pass through an authenticated proxy/jump host prior to reaching the restricted database VLAN.
Isolating high-value databases behind dedicated access gateways and isolated VLANs prevents direct network path connectivity from general application zones.

Anahtar Kavram

Multi-tier Secure Network Design, Zone Traversal, and Microsegmentation
Bu soruyu puanla

Konular

Secure Network Design and Segmentation

Bu konudan daha fazla soru