hardMultiple ChoiceObjective-mapped
CISSP Practice Question: A security architect is designing a network for a…
A security architect is designing a network for a high-security data center. The requirement is to ensure that even if an attacker compromises one server, they cannot easily move laterally to other servers in the same data center. Which network design principle should be applied?
⚠ Common exam trap
Candidates often confuse the broad strategy of defense in depth (B) with the specific technical mechanism of microsegmentation, but the question explicitly asks for a network design principle that prevents lateral movement, which is exactly what microsegmentation enforces at the data center network layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsegmentation (e.g., using virtual firewalls on each hypervisor)
Microsegmentation (D) is the correct network design principle because it enforces granular, per-workload firewall rules—often implemented via virtual firewalls on each hypervisor or using VXLAN/ACL policies—that restrict east-west traffic between servers. Even if an attacker compromises one server, microsegmentation prevents lateral movement by allowing only explicitly permitted inter-server communication, effectively isolating the breach to the compromised host.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Principle of least privilege
Why it's wrong here
The Principle of Least Privilege dictates that users, programs, or processes should be granted only the minimum necessary permissions to perform their legitimate functions. While crucial for overall security by limiting the impact of a compromised account, it primarily governs access control to data and system functions, not the network-level isolation between distinct server workloads or hypervisors to prevent lateral movement within a network segment.
- ✗
Defense in depth
Why it's wrong here
Defense in depth is a security strategy that employs multiple layers of security controls to protect assets. While essential for a robust security posture, providing redundancy and varied protection mechanisms, it is an overarching architectural philosophy rather than a specific technical solution or mechanism designed to actively segment network traffic between individual servers or virtual machines to prevent lateral movement once an initial breach occurs within a network zone.
- ✗
Single point of failure elimination
Why it's wrong here
Single point of failure elimination focuses on designing systems with redundancy and fault tolerance to ensure high availability and business continuity. Its primary objective is to prevent service disruption due to the failure of a single component, not to logically segment network traffic between individual servers or virtual machines to contain a security breach and prevent an attacker from moving laterally across the network.
- ✓
Microsegmentation (e.g., using virtual firewalls on each hypervisor)
Why this is correct
Microsegmentation is a network security technique that logically divides a data center or cloud network into distinct, isolated segments down to the individual workload level. By applying granular security policies, often via virtual firewalls or host-based agents, it creates a "zero-trust" environment between applications and servers, significantly limiting an attacker's ability to move laterally across the network even after compromising an initial system.
Visual reference
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.