An incident review finds that malware on one compromised web server reached database and backup servers in the same data center VLAN without crossing any firewall. How does microsegmentation support zero trust in this situation?
Select an answer to reveal the explanation.
Short Explanation
If every room in your house shares one key, a burglar in the kitchen owns the whole place. Microsegmentation puts a lock on each room, so the web server reaches only what it truly needs. The trap is encryption — scrambled packets still let malware connect wherever it wants.
Full Explanation
Microsegmentation applies access policy at the level of individual workloads or small groups rather than whole VLANs or subnets. Each workload is allowed only the specific flows it requires, for example the web server to the application tier on one port, while all other east-west traffic is denied by default. This enforces least privilege inside the data center and stops lateral movement of the kind seen here, where a single compromise reached databases and backups because the flat VLAN imposed no internal boundaries. Tools such as Cisco Secure Workload use application dependency mapping to discover legitimate flows and then enforce policy on hosts or through network devices. Encrypting traffic within the VLAN protects confidentiality but does not prevent malware from opening connections to other servers. Collapsing servers into one flat segment is the condition that allowed the spread, and visibility without enforcement does not stop it. Removing authentication inside a segment contradicts zero trust, which requires authentication and authorization regardless of location. Exam caveat: microsegmentation policies should start from observed traffic baselines to avoid breaking applications, typically moving from monitoring to enforcement. Operational check: review the dependency map for the web server, define allowed flows, enforce them, and confirm that connection attempts to the backup servers are now denied and logged.