Microsoft Cybersecurity Architect (SC-100)Design a Zero Trust strategy and architectureMedium
A software-as-a-service (SaaS) provider is designing its Zero Trust architecture. They host multiple customer tenants within a shared infrastructure, and strict isolation between each tenant's data and resources is paramount. The provider needs a mechanism to ensure that even if one tenant's environment is compromised, the breach cannot propagate to another tenant. Which Zero Trust architectural concept directly addresses this need for isolation?
- AMicro-segmentation
- BSecure Access Service Edge (SASE)
- CEnd-to-End Encryption
- DPrivileged Access Workstations (PAWs)
Show answer & explanationAnswer & explanation
Correct answer: A. Micro-segmentation
Micro-segmentation is the practice of dividing data centers or cloud environments into small, isolated segments, allowing for granular security policies to be applied to each segment. This prevents lateral movement and ensures strict isolation between tenant environments, even within shared infrastructure.
Why the other options are wrong
- B. Secure Access Service Edge (SASE) is a cloud-delivered security model that combines networking and security functions, focusing on secure access from users to applications, not internal segmentation between tenants.
- C. End-to-End Encryption protects data in transit and at rest but does not inherently prevent lateral movement between compromised segments.
- D. Privileged Access Workstations (PAWs) are hardened devices for administrative tasks and are not directly related to segmenting customer workloads.
Micro-segmentation
A security technique that divides data centers and cloud environments into distinct, isolated security segments down to the workload level. It allows for granular security policies to be applied to each segment, restricting lateral movement and enhancing containment of breaches.
- Divides networks into small segments
- Granular security policies per segment
- Prevents lateral movement of threats
- Enhances breach containment
Memory trick: Each workload gets its own secure box.