CAS-004 Security Architecture Practice Question
A security architect is designing a zero trust network architecture and needs to implement micro-segmentation. Which TWO of the following techniques are commonly used to achieve micro-segmentation? (Select TWO).
⚠ Common exam trap
CAS-005 often tests the confusion between traditional network segmentation (VLANs, VPNs, NAC) and true micro-segmentation (SDN policies, host-based firewalls), causing candidates to select coarse-grained network controls instead of workload-level enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Software-defined networking (SDN) policies
Option B (Software-defined networking (SDN) policies) is correct because SDN centralizes control-plane policy and lets you program fine-grained, workload-level segmentation rules (e.g., via flow tables and distributed policy enforcement) rather than relying only on coarse network boundaries. Option D (Host-based firewalls) is correct because enforcing allow/deny rules directly on each workload's OS (e.g., Windows Defender Firewall, iptables/nftables, or a host agent) provides identity- and workload-centric micro-segmentation that follows the host even across network changes. Option A (NAC) is not the intended answer here because NAC primarily controls device admission and compliance at the network edge, not granular east-west workload-to-workload policy. Option C (IPsec VPN tunnels between subnets) is not correct because it provides encrypted connectivity between subnets, not the fine-grained segmentation policy itself. Option E (VLAN segmentation) is not correct because VLANs are coarse Layer 2 broadcast-domain partitions, not the granular, often identity-based micro-segmentation required in zero trust.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network Access Control (NAC)
Why it's wrong here
NAC enforces admission control at switch or wireless ports, gating device access by identity or posture; it does not create the granular workload-to-workload policy boundaries micro-segmentation requires. It is tempting because NAC genuinely segments the campus edge, and would be correct where the requirement is onboarding or quarantining endpoints rather than east-west traffic control.
- ✓
Software-defined networking (SDN) policies
Why this is correct
Software-defined networking policies centralise control and enforce per-workload rules through a programmable controller, segmenting traffic independently of physical topology. This satisfies micro-segmentation's requirement for granular, identity- and workload-based east-west controls, unlike VLANs or subnet ACLs, which segment only at coarser network boundaries and cannot isolate individual workloads dynamically.
- ✗
IPsec VPN tunnels between subnets
Why it's wrong here
IPsec tunnels connect subnets or sites, encrypting traffic between network segments rather than enforcing per-workload policy inside them. It is tempting because IPsec is a well-understood security control, but it is designed for site-to-site or host-to-gateway confidentiality, not micro-segmentation between individual workloads.
- ✓
Host-based firewalls
Why this is correct
Host-based firewalls enforce policy at the workload's own network stack, filtering east-west traffic between individual hosts. This granular, per-workload control delivers the micro-segmentation the architect requires, unlike perimeter or VLAN-level controls that cannot isolate traffic within a subnet.
- ✗
VLAN segmentation
Why it's wrong here
VLAN segmentation operates at Layer 2 broadcast-domain granularity, grouping many hosts together, so it cannot enforce per-workload policy between individual workloads. It is tempting because VLANs are familiar and simple to deploy, but they suit coarse network separation rather than zero trust micro-segmentation.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 973-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.