Segmentation splits networks so a breach in one zone cannot freely move—VPCs, subnets, security groups, firewalls.
Patterns
- Public subnet: load balancer only
- Private subnet: app servers
- Data tier: no direct internet inbound
Link
See AWS VPC and security group lessons for cloud examples.
Important interview questions and answers
- Q: DMZ?
A: Perimeter network exposing only necessary services. - Q: East-west traffic?
A: Lateral movement inside cloud—micro-segmentation limits it.
Self-check
- Why put databases in private subnets?
- What is lateral movement?
Tip: Draw three-tier diagram: public ALB, private app, private DB.
Interview prep
- Private DB subnet?
No direct inbound internet to database tier.