ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Zero-trust networking treats every workload inside a cloud virtual network as untrusted, so only explicitly required flows should be permitted. Replacing the single permissive security group with granular, per-tier security groups lets the team specify exactly which ports each tier may use to communicate and deny all other east-west and north-south traffic by default. Because the public cloud provider enforces security-group rules at the virtual network layer, this change does not require new appliances or significant redesign.

Simply moving the VMs to a private subnet does not restrict their ability to talk to each other when network ACLs remain permissive. Depending only on host-based firewalls leaves the broad security group in place; if any host firewall is misconfigured or bypassed, lateral movement is still possible. Deploying a separate next-generation firewall adds complexity and cost and, without tightening the existing security groups, still allows unrestricted instance-to-instance traffic. Therefore, implementing least-privilege, tier-specific security groups is the most effective and straightforward way to achieve the CISO's zero-trust要求.