1.2 Design and Differentiate Between Network Segmentation and Microsegmentation NETWORK-SECURITY-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A hospital network has a legacy patient-records application that must be isolated from the general user VLAN. The application runs on a single physical server with multiple virtual machines (VMs) that must communicate only with each other and with a specific database server. The security team wants to enforce least-privilege communication between these VMs without changing the existing IP addressing scheme. Which approach best meets the requirement?

   • AMove all VMs to a single VLAN and rely on the existing network firewall to filter traffic between VMs based on IP addresses.
   • BPlace all VMs in the same VLAN and apply host-based firewall policies that allow only required traffic between the VMs and the database server.
   • CCreate a new subnet for each VM and configure the physical firewall to allow only the required inter-VM traffic.
   • DIsolate the application by placing it on a separate physical server with no network connectivity to other systems.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following best describes network segmentation?

   • AGrouping hosts into segments based on trust level or function
   • BApplying security policies to individual containers or VMs
   • CUsing a single flat network for all users and devices
   • DEncrypting all traffic between data centers
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security architect is designing a zero-trust architecture for a large enterprise with a mix of on-premises and cloud workloads. The architect must reduce lateral movement while minimizing the operational burden on the network team. The environment has a mature identity provider and supports workload identity. Which approach best meets these requirements?

   • ACreate separate VLANs for each workload and enforce firewall rules based on IP addresses.
   • BDeploy network-based intrusion detection systems in both environments to monitor for lateral movement.
   • CUse a single firewall to filter all traffic between on-premises and cloud environments.
   • DImplement microsegmentation using identity-aware policies that follow workloads across on-premises and cloud environments.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is an example of a microsegmentation technique?

   • AUsing a firewall to filter traffic between subnets
   • BApplying a security policy to a specific container based on its labels
   • CCreating a VLAN for each department
   • DAssigning IP addresses based on physical location
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary characteristic of microsegmentation?

   • AIt applies granular, per-workload or per-application security policies within a segment
   • BIt relies on physical firewalls at the network perimeter
   • CIt uses VLANs to isolate network segments
   • DIt segments the network based on IP address ranges only
   Reveal Solution Discussion Select an answer first