A school district must segment student SIS, staff administration, a…

Question

A school district must segment student SIS, staff administration, and guest Wi-Fi backends into separate subnets or VPCs, block casual lateral movement, and still allow tightly controlled access to shared services such as directory and logging. Which design best achieves this?

Accepted Answer

Place each workload class in isolated subnets or VPCs, allow only explicit routes and security group rules to shared services, and deny broad east-west paths between student, staff, and guest tiers. — Picture three locked school wings that all need the same boiler room—but not open doors between classrooms. Isolate SIS, staff, and guest backends, then poke only the holes you intend to shared services. A flat wide-open subnet is how lateral movement becomes a hallway sprint.

Answer

Put all three workload classes in one flat subnet with a single permissive security group for easier troubleshooting.

Answer

Allow unrestricted Transit Gateway spoke-to-spoke routing between every district VPC and rely on host firewalls alone.

Answer

Publish every backend on the public internet with open security groups so segmentation is unnecessary.

A school district must segment student SIS, staff administration, and guest Wi-Fi backends into separate subnets or VPCs, block casual lateral movement, and still allow tightly controlled access to shared services such as directory and logging. Which design best achieves this?

Short Explanation

Full Explanation