Examkin

Soru

Zorluk: OrtaSecure Network Design and Segmentation

A network administrator needs to establish a remote management session to perform critical database maintenance from an untrusted external network. Arrange the following network boundary transit steps and control points in the correct order, starting from the external connection initiation to the final session establishment on the internal database server.

  1. 1The remote administrator workstation initiates an encrypted SSH session targeting the enterprise public IP address.
  2. 2The perimeter firewall filters North-South ingress traffic and routes the connection to a bastion host located in the DMZ.
  3. 3The DMZ bastion host authenticates the administrator via Multi-Factor Authentication (MFA) and establishes a monitored proxy session.
  4. 4The internal firewall inspects East-West traffic and verifies firewall policy allowing management ports from the DMZ bastion IP.
  5. 5The target database server in the isolated database subnet accepts the connection from the DMZ bastion host.

Cevap

The correct sequence starts with external session initiation, passes North-South inspection at the perimeter firewall into the DMZ, authenticates at the bastion host, undergoes East-West firewall rule evaluation, and terminates at the isolated database server.
In a secure multi-tiered network design, incoming external administrative traffic must first cross the perimeter firewall into a screened network segment (DMZ). The session is authenticated and proxied by a DMZ bastion host before initiating a separate internal connection. This East-West transit from the DMZ to the internal database zone is separately controlled and filtered by an internal firewall before reaching the destination database server.

Adım Adım Çözüm

1
Identify the entry point of external network traffic.
The initial step is the remote administrator workstation sending traffic across the Internet toward the enterprise network edge.
Traffic originates at the remote client before reaching internal enterprise security controls.
2
Evaluate perimeter access control and DMZ redirection.
The perimeter firewall processes North-South ingress traffic and restricts access directly to the DMZ bastion host.
Secure network design prohibits direct external access to internal subnets; all management traffic must terminate in a screened zone first.
3
Enforce identity verification and administrative proxy controls.
The DMZ bastion host authenticates the administrator via MFA and establishes a proxy channel.
Jump servers/bastion hosts act as intermediate staging points to validate identity before granting access to internal zones.
4
Inspect inter-zone East-West network traffic.
The internal firewall evaluates rule sets governing traffic moving between the DMZ subnet and the internal database subnet.
Internal segment isolation ensures that only explicitly permitted source IP addresses (the bastion host) can connect across internal zone boundaries.
5
Complete session establishment on the internal target endpoint.
The database server receives and accepts the management session request.
The destination endpoint processes the connection request after all perimeter and internal segmentation controls have validated the flow.

Anahtar Kavram

Multi-Tier Network Boundary Segmentation and Jump Server Session Transit Controls
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Secure Network Design and Segmentation

Bu konudan daha fazla soru