A data center's only Cisco Secure Firewall sits at the internet edge. Web, application and database servers in separate VLANs route to each other on the core switch, and a compromised web server connected straight to the database. Which design change addresses this?
Select an answer to reveal the explanation.
Short Explanation
Locking the front door doesn't help when the burglar is already inside and every room is open. The attacker here moved sideways, server to server, and that traffic never touched the edge. You'll see answers that beef up the edge; skip them, because the fix is inspecting traffic between the rooms.
Full Explanation
North-south traffic crosses the boundary between the data center and the outside world; east-west traffic moves between systems inside the data center. When the core switch routes between VLANs, inter-tier traffic is forwarded locally and never reaches an edge firewall, so a compromised web server can contact the database freely. Placing firewall and intrusion prevention inspection on the inter-VLAN path, for example by making the firewall the gateway for those VLANs, using a dedicated internal segmentation firewall, or enforcing workload-level microsegmentation, lets policy permit only the flows each tier needs and inspect them for exploits. A second edge firewall in series doubles north-south inspection but still never sees traffic switched inside the data center. URL filtering controls web destinations and might limit outbound browsing, but it does not inspect or block a server-to-database connection on the internal network. An aggressive intrusion policy at the edge has the same blind spot; the attack path bypasses that device entirely. Exam caveat: segmentation can also be expressed with security group tags or workload policy, but the principle remains that internal flows must cross an enforcement point. Operational check: after the change, confirm connection events show web-to-database flows being evaluated, and that only the application tier can reach the database port.