Examkin

Soru

Zorluk: OrtaSecure Network Design and Segmentation

A network security architect is implementing defense-in-depth segmentation to secure access from external users to an isolated internal backend database. Arrange the network transit points and security control boundaries in the correct sequence through which inbound traffic must flow from the untrusted Internet to the database server.

  1. 1Perimeter Web Application Firewall (WAF) in the Demilitarized Zone (DMZ)
  2. 2Reverse Proxy and API Gateway in the Public Services Subnet
  3. 3Internal Microsegmentation Firewall controlling East-West traffic
  4. 4Database Subnet Access Control List (ACL) and Host Firewall

Cevap

The correct ingress sequence flows from the Perimeter WAF in the DMZ, to the Reverse Proxy/API Gateway in the Public Services Subnet, through the Internal Microsegmentation Firewall, and finally to the Database Subnet ACL and Host Firewall.
Secure network architecture mandates a defense-in-depth approach where inbound traffic traverses from public edge boundaries to increasingly restrictive internal zones. Traffic first enters the DMZ via the Perimeter WAF, moves to the API Gateway in the public services tier for authentication, passes through an internal microsegmentation firewall inspecting East-West flows, and lastly encounters the Database Subnet ACL and Host Firewall enforcing strict destination isolation.

Adım Adım Çözüm

1
Filter North-South traffic at the network edge
Untrusted external traffic is inspected by the Perimeter WAF in the DMZ.
Perimeter security controls must evaluate incoming public requests first to block common web attacks before traffic reaches internal endpoints.
2
Terminate external connections and validate application requests
The Reverse Proxy/API Gateway handles session termination and request verification.
De-encapsulating and authenticating requests in a public-facing service subnet prevents unverified external clients from directly connecting to internal application instances.
3
Enforce East-West microsegmentation boundaries
The Internal Microsegmentation Firewall evaluates traffic traveling between application tiers.
Microsegmentation prevents lateral movement by explicitly inspecting and controlling data flows transitioning across internal zone boundaries.
4
Apply host and subnet-level isolation controls
Database Subnet ACLs and Host Firewalls enforce zero trust rules at the target resource.
Final line-of-defense controls restrict access strictly to authorized source IP addresses and database-specific communication protocols.

Anahtar Kavram

Multi-tier network segmentation and zoning boundaries control the flow of ingress and lateral traffic across security zones based on least privilege and defense-in-depth.
Bu soruyu puanla

Konular

Secure Network Design and Segmentation

Bu konudan daha fazla soru