hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Has recently migrated its on-premises data center…
An organization has recently migrated its on-premises data center to a public cloud. The security team notices that several virtual machines (VMs) in the same subnet are communicating with each other without any restrictions. The company policy requires that only specific application traffic (e.g., database queries from web servers) be allowed between VMs, and all other inter-VM traffic must be blocked to comply with a zero-trust model. The cloud provider offers native security group and network ACL features. The architect must design a solution that enforces the policy with minimal administrative overhead and supports future expansion.
Which of the following is the BEST course of action?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place all VMs in the same subnet and configure security groups that only allow necessary inter-VM traffic (e.g., web-to-db), with a default deny rule
Security groups are stateful firewalls that operate at the instance level and are deny-by-default. By placing all VMs in the same subnet and applying security groups with allow rules only for required application traffic (e.g., web-to-db), we enforce zero-trust principles: all traffic is denied unless explicitly allowed. This minimizes administrative overhead because security groups are easy to manage and do not require separate subnetting or additional appliances. Option A is incorrect because moving to separate VPCs introduces unnecessary complexity and VPC peering overhead. Option C is incorrect because network ACLs are stateless and require explicit inbound and outbound rules for each flow, increasing administrative effort. Option D is incorrect because a third-party firewall adds cost and complexity without providing additional security benefit beyond what native security groups already offer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Move each application tier to a separate VPC and use VPC peering with strict routing policies
Why it's wrong here
This adds unnecessary complexity and cost; VPC peering does not provide micro-segmentation within a tier.
- ✓
Place all VMs in the same subnet and configure security groups that only allow necessary inter-VM traffic (e.g., web-to-db), with a default deny rule
Why this is correct
Security groups are stateful and evaluated at the instance level; they allow fine-grained control with default deny.
- ✗
Place all VMs in the same subnet and configure network ACLs with explicit allow rules for required traffic and a deny-all rule for other traffic
Why it's wrong here
Network ACLs are stateless, requiring both inbound and outbound rules, which adds complexity; also they apply to the entire subnet, not individual VMs.
- ✗
Keep all VMs in the same subnet but deploy a third-party next-generation firewall as a virtual appliance to inspect and filter inter-VM traffic
Why it's wrong here
Deploying a third-party next-generation firewall as a virtual appliance introduces a chokepoint that must be explicitly routed through, whereas native cloud security groups enforce microsegmentation at the hypervisor layer without traffic hair-pinning. This fails the requirement for minimal administrative overhead because every new VM requires manual routing rules to force traffic through the appliance, and the appliance itself becomes a scaling bottleneck. It is tempting because next-generation firewalls provide deep packet inspection and application-layer filtering, which would be the correct choice if the policy required decrypting or inspecting encrypted inter-VM traffic rather than simply blocking all non-whitelisted flows.
Visual reference
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.