2 Network Segmentation Free Online FlashCards

What is network segmentation?

Network segmentation divides an environment into zones and controls the traffic allowed between them.

How can segmentation limit the impact of a compromised device?

It can help contain a compromised device and reduce an attacker’s opportunities for lateral movement.

Does segmentation replace other security controls?

Segmentation supports security but does not replace authentication, patching, endpoint protection, or monitoring.

What should guide the design of network zones?

Group systems with similar purposes and security requirements, rather than grouping them only by building or department.

What belongs in a DMZ?

A DMZ is a zone for public-facing services that must accept connections from outside the organization.

Why doesn’t creating separate subnets guarantee isolation?

A subnet alone is not a security boundary: a router may still forward traffic freely between subnets.

What can enforce boundaries between network zones?

Use network firewalls, router access-control lists, host firewalls, cloud security controls, or suitable combinations to enforce boundaries.

What details should a segmentation flow policy specify?

Specify the source, destination, service or protocol, direction, and business reason for each required flow.

How should access to a database be limited in a tiered application?

Allow the application service to reach the database on its required database port; users should access data through the application instead of connecting directly.

Why restrict outbound network traffic?

Restrict outbound traffic where practical because unrestricted egress can let compromised systems communicate with external services.

How can teams check that segmentation works as intended?

Test both permitted and prohibited flows, and monitor important boundary traffic, especially unexpected connections to sensitive zones.

What is the purpose of a management zone?

It contains administrative workstations and interfaces used to manage infrastructure.