A city's microservices platform firewalled only north-south Internet edges while east-west service-to-service chatter remains unmonitored and unrestricted. What design correction is needed?
Select an answer to reveal the explanation.
Short Explanation
Guarding the front door while cubicles pass secrets hand-to-hand is yesterday's castle model. East-west traffic inside needs eyes and limits too—not just the Internet edge.
Full Explanation
A microservices platform that firewalled only north-south Internet edges while leaving east-west service-to-service traffic unmonitored and unrestricted inherits castle-and-moat failure modes. North-south controls stop some external entry, but once an identity or pod is compromised, unrestricted east-west chatter enables lateral movement, data staging, and stealthy pivots. The needed correction is to apply authentication, authorization, segmentation, and monitoring to both north-south and east-west flows.
Removing the north-south firewall because “edge is obsolete” discards useful defense-in-depth. Permanently trusting all east-west traffic once inside the cluster network is the flat-trust assumption zero-trust networking rejects. Disabling service-mesh telemetry to reduce logs blinds detection of internal abuse.
Exam caveat: CISSP Domain 4 distinguishes north-south versus east-west and expects controls in both directions for modern application networks.
Operational check: enforce mTLS or equivalent service identity; define network policies between namespaces/services; retain edge protections; centralize flow and allow-deny telemetry; alert on unexpected east-west paths; periodically review mesh policies after new services deploy.