easyMultiple ChoiceObjective-mapped
CCSP Practice Question: A cloud operations team is setting up a new…
A cloud operations team is setting up a new virtual network in the cloud. They need to segment traffic between different tiers of an application (web, application, database). Which security control should they implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network access control lists and security groups
Network access control lists (NACLs) and security groups are the correct controls for segmenting traffic between application tiers. NACLs act as stateless firewalls at the subnet level, while security groups provide stateful filtering at the instance level. Together they allow or deny traffic based on rules, effectively isolating web, application, and database tiers. Intrusion detection systems (IDS) monitor for malicious activity but do not control traffic flow. Data loss prevention (DLP) focuses on preventing data exfiltration. Web application firewalls (WAF) protect against web-specific attacks at layer 7 and are not designed for general network segmentation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Network access control lists and security groups
Why this is correct
NACLs and security groups filter traffic based on rules, enabling segmentation.
- ✗
Intrusion detection system
Why it's wrong here
IDS detects but does not block traffic.
- ✗
Data loss prevention
Why it's wrong here
DLP prevents data exfiltration, not network segmentation.
- ✗
Web application firewall
Why it's wrong here
WAF protects web applications, not network segmentation.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.