An online gaming platform runs web front ends, game logic, and player databases in one flat VPC, with lateral movement risk between tiers and internet exposure of databases. Compliance requires isolated subnets and controlled east-west traffic with north-south filtering. Which network segmentation design meets these security requirements?
Select an answer to reveal the explanation.
Short Explanation
You've got your web, game, and data layers all sharing one open room right now, so once an attacker gets in, they've got free rein. That's like moving each tier to its own locked floor with hall monitors, using tiered subnets with NACLs and security groups to filter traffic both ways.
Full Explanation
Tiered segmentation places load balancers in public subnets, application logic in private subnets, and databases in isolated data subnets with no internet routes, while stateless NACLs and stateful security groups enforce east-west allowlists between tiers and north-south inspection at the edge, addressing lateral movement and exposure. A single flat subnet with permissive security groups preserves the current risk by allowing unrestricted east-west communication and failing to provide isolation. VPC Traffic Mirroring copies traffic for inspection but does not enforce segmentation or block flows, so it cannot isolate databases or control inter-tier access. Placing internet gateways in every subnet expands internet exposure rather than filtering, and gateways alone provide no packet filtering for east-west or north-south control. On the exam, map north-south to edge ingress-egress and east-west to inter-subnet controls, and in practice verify route tables have no internet routes for data subnets and test security group references tier to tier.