CAS-004 Security Architecture Practice Question
A company is implementing a zero trust architecture. Which of the following BEST describes the principle of micro-segmentation in this model?
⚠ Common exam trap
Test-takers frequently confuse traditional network segmentation (VLANs, subnets, perimeter firewalls) with micro-segmentation, which operates at the workload/vNIC level with granular per-workload policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolating workloads at the virtual network interface level with granular security policies
Micro-segmentation in a zero trust architecture isolates individual workloads at the virtual network interface level and enforces granular, per-workload security policies. This limits lateral movement because each workload becomes its own security zone, and traffic between workloads is explicitly allowed or denied based on identity and policy rather than network location. It is a foundational zero trust control that assumes no implicit trust based on being 'inside' the network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Creating a single perimeter around the entire network
Why it's wrong here
A single perimeter is the traditional castle-and-moat model that zero trust explicitly rejects; micro-segmentation assumes no trusted internal network and enforces policy per workload. It is tempting because perimeter defence remains common, and would be correct when the requirement is protecting an environment where internal traffic is inherently trusted.
- ✓
Isolating workloads at the virtual network interface level with granular security policies
Why this is correct
Micro-segmentation creates granular, workload-level security policies enforced at each virtual network interface, so lateral movement between workloads is blocked regardless of subnet boundaries. This satisfies zero trust's requirement to isolate individual workloads rather than trusting the network perimeter.
- ✗
Using VLANs to separate departments
Why it's wrong here
VLANs segment at the network layer by subnet or department, permitting broad east-west reachability within each segment rather than per-workload policy enforcement. It is tempting because VLANs are a familiar segmentation tool, and would be correct when the requirement is coarse traffic isolation between network broadcast domains.
- ✗
Implementing a VPN for remote access
Why it's wrong here
A VPN authenticates and encrypts remote user traffic to the corporate network, then grants broad internal access rather than workload-level policy enforcement. It is tempting because VPNs address remote-access security, and would be correct when the requirement is securing connectivity for off-site users to internal resources.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.