A school district must segment student SIS, staff administration, and guest Wi-Fi backends into separate subnets or VPCs, block casual lateral movement, and still allow tightly controlled access to shared services such as directory and logging. Which design best achieves this?
Select an answer to reveal the explanation.
Short Explanation
Picture three locked school wings that all need the same boiler room—but not open doors between classrooms. Isolate SIS, staff, and guest backends, then poke only the holes you intend to shared services. A flat wide-open subnet is how lateral movement becomes a hallway sprint.
Full Explanation
School-district segmentation succeeds when student SIS, staff administration, and guest Wi-Fi backends occupy isolated subnets or VPCs, with routes and security group rules that permit only explicit access to shared services such as directory and logging. East-west paths between student, staff, and guest tiers stay denied by default so a compromise in the guest backend cannot casually traverse into SIS. Shared services remain reachable through narrowly scoped allow-lists, preserving the “common boiler room” without unlocking classroom-to-classroom movement. Network ACLs can add coarse subnet guardrails, but stateful security groups remain the primary instance- or ENI-level control.
Placing all three workload classes in one flat subnet with a single permissive security group maximizes troubleshooting convenience and lateral movement alike; it directly contradicts least-privilege segmentation. Unrestricted Transit Gateway spoke-to-spoke routing between every district VPC, with only host firewalls as a backstop, recreates transitive trust the district asked to block and pushes enforcement to inconsistent host configurations. Publishing every backend on the public internet with open security groups abandons private segmentation entirely and expands the student-data attack surface without necessity.
Exam caveat: SAP-C02 expects layered controls—VPC/subnet isolation, route discipline, and security groups—rather than “one big VPC plus hope”; TGW without route-table segmentation is not automatic microsegmentation. Operational check: from a guest-tier host, verify directory/logging ports to shared services succeed while SIS endpoints time out; review TGW or VPC routes for absent cross-tier prefixes; and confirm CloudWatch or flow logs show denied attempts when east-west probes are tested.