A security architect is designing network zones for a new enterprise. Which principle governs how services should be placed across zones to minimize attack surface?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because placing a service in the zone with the minimum required trust level ensures it is only reachable by the networks that legitimately need it; for example, a public web server goes in a low-trust DMZ exposed to the internet, not the internal high-trust zone. A is wrong because consolidation in a single zone eliminates the security benefit of segmentation and increases blast radius.
Full explanation below image
Full Explanation
B is correct because placing a service in the zone with the minimum required trust level ensures it is only reachable by the networks that legitimately need it; for example, a public web server goes in a low-trust DMZ exposed to the internet, not the internal high-trust zone. A is wrong because consolidation in a single zone eliminates the security benefit of segmentation and increases blast radius. C is wrong because no segmentation allows direct access to all services from all internal hosts, maximizing lateral movement opportunities. D is wrong because placing public services in high-trust internal zones exposes sensitive internal resources to compromised public-facing systems.