An organization relies on a strong perimeter firewall but has a flat internal network with no endpoint protection. A malicious insider moves freely from a workstation to file servers and the HR database. What is the PRIMARY gap in the security design?
Select an answer to reveal the explanation.
Short Explanation
A hard shell with a soft center is like an egg: crack it once and everything spills out. An insider is already inside the shell, so a better perimeter does nothing. You need walls inside the house, too.
Full Explanation
Defense in depth requires controls at multiple layers, not only at the network edge. A perimeter firewall inspects traffic crossing the boundary, but an insider already operates inside that boundary, and a flat network allows any workstation to reach any server. Internal segmentation, such as VLANs with access control between zones or microsegmentation for sensitive systems, restricts lateral movement, while endpoint protection detects and blocks malicious activity on hosts. Together they limit an insider or a compromised workstation to a small portion of the environment. Adding outbound deny rules on the perimeter may reduce data exfiltration to the internet, but it does nothing to stop internal access to file servers and the HR database. Enabling inbound intrusion prevention strengthens the edge against external attackers, which is not the threat described. Providing a VPN for remote workers secures a different path entirely and has no bearing on movement inside the office network. Exam caveat: stems that describe lateral movement, a flat network, or a hard perimeter with a soft interior point to internal layers rather than to perimeter improvements. Operational check: map which subnets can reach the HR database and file servers, restrict access to required application flows, deploy endpoint detection on all hosts, and confirm that workstation-to-workstation traffic is limited.