A security engineer is faced with competing requirements from the networking group and database
administrators. The database administrators would like ten application servers on the same subnet
for ease of administration, whereas the networking group would like to segment all applications
from one another. Which of the following should the security administrator do to rectify this issue?
A.
Recommend performing a security assessment on each application, and only segment the
applications with the most vulnerability
B.
Recommend classifying each application into like security groups and segmenting the groups
from one another
C.
Recommend segmenting each application, as it is the most secure approach
D.
Recommend that only applications with minimal security features should be segmented to
protect them
Confusing question. A sounds good to me but B is the answer?
0
0
It is a poorly worded question with a few catches.
As we all know (or should know by now) a Network segmentation in computer networking is the act or practice of splitting a computer network into subnetworks, each being a network segment. Advantages of such splitting are primarily for boosting performance and improving security.
So it is a given that as a minimum, all applications must of necessity already be in the same subnet or segmentation.
“A.Recommend performing a security assessment on each application, and only segment the applications with the most vulnerability”. This is badly worded as all applications will be segmented at the end of the day. If they had said “Recommend performing a security assessment on each application, and segment the applications with the most vulnerability to another segment”, then that would make more sense.
“C.Recommend segmenting each application, as it is the most secure approach” is a bit of an overkill.
“D. Recommend that only applications with minimal security features should be segmented to protect them”. This is badly worded as all applications will be segmented at the end of the day.
So “B.Recommend classifying each application into like security groups and segmenting the groups from one another” makes more sense
This way we would have a segment for the secure applications and another for the most vulnerable applications”
2
0