1.2 Design and Differentiate Between Network Segmentation and Microsegmentation NETWORK-SECURITY-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A large enterprise is moving a legacy monolithic application to a containerized microservices architecture. The security team wants to enforce least-privilege communication between individual microservices, but the environment is highly dynamic—services scale up and down frequently and IP addresses change. Which segmentation approach is most appropriate?

   • ACreate a separate VLAN for each microservice and configure firewall rules based on IP addresses.
   • BPlace all microservices in a single subnet and rely on the cloud provider's default security groups.
   • CDisable all inter-service communication and require each service to communicate only through a message queue.
   • DUse microsegmentation with identity-aware policies that follow the workload regardless of IP address changes.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A healthcare organization must comply with regulations that require strict separation between patient data systems and general IT systems. The organization has a static on-premises environment with a well-defined network topology. Which approach is most appropriate?

   • AImplement microsegmentation on every server to enforce per-workload policies.
   • BPlace all systems on the same network and rely on encryption to protect patient data.
   • CUse traditional network segmentation with VLANs and firewalls to separate the two environments.
   • DUse a single firewall with a default-deny rule for all traffic.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is planning to implement microsegmentation across its data center. The security team has identified that some legacy applications cannot support host-based agents. The architect must still achieve granular segmentation for these applications. Which approach is most appropriate?

   • AUse traditional VLAN segmentation for legacy applications and microsegmentation for others.
   • BUse a combination of network-based microsegmentation (e.g., policy enforcement at the virtual switch) and host-based agents where supported.
   • CForce legacy applications to be migrated to new hardware that supports agents.
   • DExclude legacy applications from segmentation because they cannot support agents.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A financial services company is designing a zero-trust architecture for its multi-tier application. The web tier, application tier, and database tier are each deployed in separate subnets with a firewall between them. The security team wants to further reduce the risk of lateral movement if an attacker compromises a single web server. Which additional control best addresses this concern?

   • AIncrease the number of firewall rules to allow all traffic between the tiers for easier management.
   • BDeploy an intrusion prevention system (IPS) inline between the web and application tiers.
   • CAdd more subnets to separate each server into its own broadcast domain.
   • DImplement microsegmentation policies that restrict each web server to communicate only with its specific application server and nothing else.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a key security benefit of microsegmentation compared to traditional network segmentation?

   • AIt provides stronger perimeter defenses
   • BIt reduces the attack surface by isolating individual workloads
   • CIt simplifies network management
   • DIt eliminates the need for encryption
   Reveal Solution Discussion Select an answer first