A security architect is evaluating the effectiveness of network segmentation versus microsegmentation in preventing advanced persistent threats (APTs) that use legitimate credentials to move laterally. Which approach provides the strongest defense against this type of attack?

Using multi-factor authentication (MFA) for all user access.

Deploying a honeypot to detect lateral movement attempts.

Microsegmentation with identity-aware policies that restrict communication based on workload identity and least privilege.

Traditional network segmentation with VLANs and firewall rules based on IP addresses.

What is an operational implication of microsegmentation compared to traditional segmentation?

It reduces the number of security policies needed

It eliminates the need for monitoring

It is less scalable than traditional segmentation

It typically requires more granular policy management

A company is adopting a zero-trust model and wants to implement microsegmentation. The security team is concerned about the operational impact of managing many granular policies. Which strategy can help mitigate the management complexity?

Create a separate policy for every possible communication path to ensure maximum security.

Rely on manual firewall rule changes for each new workload.

Use a centralized policy management platform that provides visibility and automation for microsegmentation policies.

Use only host-based microsegmentation agents without any central management.

What is the primary purpose of network segmentation in a zero trust architecture?

To apply granular security policies to individual workloads within a single segment

To replace all physical firewalls with virtual firewalls

To divide a network into smaller, isolated segments based on trust zones or functional boundaries

To eliminate the need for any security controls within the network

Which statement accurately describes microsegmentation?

It is a network-level control that divides the network into large broadcast domains

It is only applicable to on-premises data centers

It enforces security policies at the individual workload or application level

It requires dedicated hardware for each segment

Palo Alto NetworksCertified Network Security Architect

Domain 1Objective 2

1.2 Design and Differentiate Between Network Segmentation and Microsegmentation NETWORK-SECURITY-ARCHITECT Practice Questions (Page 5)

Part of the Zero Trust Enterprise domain, which accounts for 8% of the NETWORK-SECURITY-ARCHITECT exam.

26questions here

6free pages

6concepts

8%of the exam

Questions 21–25

21expert · hard
A security architect is evaluating the effectiveness of network segmentation versus microsegmentation in preventing advanced persistent threats (APTs) that use legitimate credentials to move laterally. Which approach provides the strongest defense against this type of attack?
Select an answer first
22foundation · easy
What is an operational implication of microsegmentation compared to traditional segmentation?
Select an answer first
23expert · hard
A company is adopting a zero-trust model and wants to implement microsegmentation. The security team is concerned about the operational impact of managing many granular policies. Which strategy can help mitigate the management complexity?
Select an answer first
24foundation · easy
What is the primary purpose of network segmentation in a zero trust architecture?
Select an answer first
25foundation · easy
Which statement accurately describes microsegmentation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NETWORK-SECURITY-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NETWORK-SECURITY-ARCHITECT” is a trademark of its owner, used for identification only.