Question

A financial services company is adopting the Microsoft Zero Trust framework. Their security team observes that once an attacker compromises a single workload in their flat Azure virtual network, they can freely move to other workloads and reach sensitive database tiers. Leadership asks the cybersecurity architect to design a solution that aligns with the Zero Trust 'assume breach' principle to contain lateral movement across their Azure network estate. Which design approach BEST aligns with this Zero Trust guiding principle?

Accepted Answer

Implement microsegmentation using network security groups, application security groups, and Azure Firewall to enforce least-privilege, explicit traffic flows between workload tiers.

Answer

Deploy a single large virtual network with a perimeter firewall at the edge and trust all internal east-west traffic to maximize application performance.

Answer

Require multifactor authentication for all administrative accounts and rely on identity controls alone to prevent lateral movement.

Answer

Enable Azure DDoS Protection Standard and Web Application Firewall on all public endpoints to block external attackers from entering the network.