Study 4 Network Segmentation and Isolation with 12 free online flashcards. Review key terms, definitions, and concepts with this interactive flashcard deck.
What security benefits do segmentation and isolation provide?
Segmentation divides an environment into security zones and controls traffic between them; isolation limits communication paths, helping contain compromises, mistakes, and outages.
Does being inside a security zone automatically make a system trustworthy?
No. A system's network location alone should not grant access; zero-trust design evaluates and authorizes access to each resource.
What should determine how security zones are designed?
Define zones by resource sensitivity, purpose, and required access—not only by physical location or IP range.
What is the role of an ingress zone?
An ingress zone contains public-facing load balancers or gateways that receive external requests.
What should an explicit zone-boundary traffic policy specify?
Specify the allowed source, destination, service or port, direction, and reason. Deny traffic by default and permit only documented, necessary flows.
How should traffic from an ingress gateway to an application be restricted?
Allow the ingress gateway to forward requests to the application service on its required application port; the database should not be reachable from the public-facing zone.
Why restrict outbound traffic from workloads?
Restrict outbound traffic so workloads contact only required services, such as approved APIs, DNS resolvers, or update repositories.
What should justify a service-to-service request?
Allow a request because the calling service is authenticated and authorized for the resource—not merely because both services share a subnet.
How should permissions for a reporting service be scoped?
Grant only the access needed: for example, a reporting service may read selected records without permission to modify them.
Why use enforcement controls at multiple levels?
Combine network or subnet rules, workload-level rules, gateways or proxies, and host or application controls as appropriate to enforce boundaries at multiple levels.
How do AWS security groups and network ACLs differ in statefulness?
AWS security groups are stateful; network ACLs are stateless, so ACLs require explicit rules for return traffic.
What practices help keep segmentation effective over time?
Document approved flows, owners, and purposes; compare observed traffic with policy, remove obsolete or broad rules, monitor unexpected paths, and periodically test boundaries.