A payment processor must isolate cardholder databases in private subnets with no internet egress, while containing lateral movement between application tiers and inspecting all inbound and outbound internet traffic. Compliance requires distinct controls for traffic entering or leaving versus tier-to-tier flows. Which design should the architect implement for network segmentation?

The correct pattern keeps cardholder databases in isolated subnets with no internet route while enabling required platform access through VPC endpoints, enforces east-west tier separation with stateful security groups to contain lateral movement, and directs all north-south internet traffic through Gateway Load Balancer security appliances for inbound and outbound inspection, thereby providing distinct controls for perimeter versus inter-tier flows as compliance demands. A private-subnet design that retains NAT gateways for updates is operationally common for patching but violates the no-egress concept because NAT still creates an outbound internet path so the subnet is not isolated. A consolidated design that filters both edge and inter-tier traffic through the same Gateway Load Balancer appliances supports central visibility but violates the distinct-controls concept because one control plane is used where two separate mechanisms are required. A NAT-gateway plus network ACL design for internet connectivity is standard for basic egress and stateless filtering but violates the inspection concept because translation and ACLs do not provide full threat and content inspection. Exam caveat: distinguish isolated subnets with endpoints from private subnets with NAT, since exams test that nuance explicitly. Practical check: audit subnet route tables for absent default routes, review security-group tier rules, and validate with traffic tests that edge flows traverse inspection.