1.2 Design and Differentiate Between Network Segmentation and Microsegmentation NETWORK-SECURITY-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security architect is designing segmentation for a hybrid cloud environment. The on-premises data center has static workloads, while the cloud environment has dynamic workloads that scale frequently. The architect must ensure consistent security policies across both environments. Which approach is most appropriate?

   • AUse microsegmentation only in the cloud and rely on the perimeter firewall for on-premises.
   • BUse separate security tools for each environment to avoid integration issues.
   • CUse traditional VLAN segmentation on-premises and microsegmentation in the cloud.
   • DUse a single microsegmentation platform that supports both on-premises and cloud workloads with consistent identity-aware policies.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A cloud-native company runs its application on Kubernetes. The security team wants to enforce policies that allow only specific pods to communicate with each other, regardless of the node they run on. Which approach aligns with microsegmentation principles?

   • ADisable all pod-to-pod communication and require all traffic to go through a service mesh proxy.
   • BCreate separate VPCs for each pod and route traffic through a central firewall.
   • CUse Kubernetes NetworkPolicies to define allow rules based on pod labels.
   • DConfigure security groups on each node to filter traffic between pods.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which architectural difference is associated with microsegmentation?

   • AIt is only suitable for small networks
   • BIt requires a separate firewall for each workload
   • CIt relies on physical network topology for policy enforcement
   • DIt is typically implemented in software and can follow workloads across environments
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is considering moving from a traditional VLAN-based segmentation model to a microsegmentation model. The security team is concerned about the operational impact of this change. Which of the following is a key operational consideration when adopting microsegmentation?

   • AMicrosegmentation requires no changes to existing network infrastructure.
   • BMicrosegmentation eliminates the need for firewall rules entirely.
   • CMicrosegmentation is less scalable than traditional segmentation because it relies on physical network changes.
   • DMicrosegmentation requires more granular policy management and ongoing visibility into workload communication.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A large enterprise is experiencing frequent security incidents where attackers move laterally between servers after compromising a single endpoint. The security team wants to implement a solution that prevents lateral movement without requiring changes to the existing IP addressing scheme. Which approach is most effective?

   • ACreate new VLANs for each server and configure firewall rules to block inter-VLAN traffic.
   • BUse a security information and event management (SIEM) system to detect lateral movement after it occurs.
   • CImplement a network access control (NAC) solution to authenticate devices before they join the network.
   • DDeploy microsegmentation with host-based policies that restrict communication to only the required ports and protocols between workloads.
   Reveal Solution Discussion Select an answer first