Separate a public web tier from a private database tier in the cloud.
What is the main purpose?
Network separation limits direct reachability to the database and reduces lateral movement after a compromise.
Detailed explanation
Incorrect. Exposing every port to the Internet is the opposite of separation.
Incorrect. Exposing every port to the Internet is the opposite of separation.
Incorrect. Removing encryption is not the goal of network segmentation.
Incorrect. Removing encryption is not the goal of network segmentation.
Correct. Restricting external reachability and paths between tiers reduces the attack surface.
Correct. Restricting external reachability and paths between tiers reduces the attack surface.
Incorrect. Segmentation does not replace backups.
Incorrect. Segmentation does not replace backups.
Try it yourself
An example you can run in a temporary verification environment.
printf '%s\n' 'public tier and private data tier have restricted paths'Expected result
public tier and private data tier have restricted pathsKey points
- Network separation
- Reachability
- Lateral movement
Notes
- Environment: クラウドネットワーク設計の概念確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.