5.3 Segmentation, Microsegmentation, SDN, VPC, and Zero Trust

CISSP Study Guide Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: CISSP Orientation, CAT, and Official Source Control

1.1 Credential Scope, CISSP Mindset, and Search Language 1.2 Exam Outline Effective Date and Eight-Domain Map 1.3 CAT Format, 100-150 Items, and Forward-Only Rules 1.4 Passing Grade, Results, Feedback, and Retake Policy 1.5 Experience, Endorsement, and Associate of ISC2 Path 1.6 Pricing, AMF, CPE, and Maintenance Overview

2 Chapter 2: Security and Risk Management

2.1 Professional Ethics, CIA, and Security Governance 2.2 Policies, Standards, Procedures, Guidelines, and Control Ownership 2.3 Legal, Regulatory, Privacy, and Investigation Context 2.4 Risk Identification, Analysis, Treatment, and Reporting 2.5 Business Continuity, BIA, and Recovery Prioritization 2.6 Personnel Security, Training, Awareness, and Culture 2.7 Threat Modeling, Supply Chain Risk, and Third-Party Governance 2.8 Security and Risk Management Case Lab

3 Chapter 3: Asset Security and Data Lifecycle

3.1 Asset and Data Classification, Ownership, and Roles 3.2 Handling Requirements, Labeling, Privacy, and Cross-Border Data 3.3 Data States and Protection Methods: DLP, DRM, and CASB 3.4 Data Lifecycle, Retention, Remanence, and Destruction 3.5 Secure Provisioning, Inventory, and Asset Management 3.6 Asset Security Case Lab

4 Chapter 4: Security Architecture, Engineering, and Cryptography

4.1 Secure Design Principles and Security Models 4.2 Control Selection, System Security, and Architecture Risk 4.3 Cryptography Foundations: Symmetric, Asymmetric, Hashing, and PKI 4.4 Cryptographic Lifecycle, Key Management, and Attack Patterns 4.5 Cloud, Container, IoT, Edge, and Shared Responsibility Architecture 4.6 Physical Site, Facility, and Environmental Security 4.7 Information System Lifecycle Engineering and Retirement 4.8 Architecture and Engineering Case Lab

5 Chapter 5: Communication, Network Security, and Zero Trust

5.1 Network Architecture, OSI/TCP/IP, and Secure Design 5.2 Secure Protocols, Encryption in Transit, and Channel Protection 5.3 Segmentation, Microsegmentation, SDN, VPC, and Zero Trust 5.4 Wireless, Cellular, Remote Access, and Third-Party Connectivity 5.5 Network Components: NAC, IDS/IPS, Firewalls, and Endpoints 5.6 Monitoring, Observability, Capacity, and Resilient Communications 5.7 Communication and Network Security Case Lab

6 Chapter 6: Identity and Access Management

6.1 Identity Proofing, Authentication, Authorization, and Accountability 6.2 Access Control Models: RBAC, MAC, DAC, ABAC, and Risk-Based Access 6.3 Federation, SSO, MFA, Passwordless, and Session Management 6.4 Provisioning, Deprovisioning, JML, and Access Reviews 6.5 Service Accounts, Non-Human Identities, and Privilege Management 6.6 Physical, Logical, Cloud, and Hybrid Access Boundaries 6.7 IAM Case Lab

7 Chapter 7: Security Assessment, Testing, and Audit Strategy

7.1 Assessment, Test, and Audit Strategy Selection 7.2 Control Testing, Vulnerability Assessment, and Penetration Testing 7.3 Log Review, Code Review, Misuse Cases, and Compliance Checks 7.4 Security Process Data, KPIs, KRIs, and Reporting 7.5 Remediation, Exceptions, Risk Acceptance, and Evidence Quality 7.6 Security Assessment and Testing Case Lab

8 Chapter 8: Security Operations, Incident Response, and Resilience

8.1 Investigations, Evidence, Forensics, and Legal Readiness 8.2 Logging, Monitoring, SOC, and Alert Triage 8.3 Configuration, Change, Patch, and Vulnerability Operations 8.4 Incident Management, Containment, Eradication, and Recovery 8.5 Disaster Recovery, Backup, Availability, and Resilience 8.6 Physical Security Operations and Safety 8.7 Security Operations Case Lab

9 Chapter 9: Software Development Security and DevSecOps

9.1 Secure SDLC Governance and Requirements 9.2 Architecture, Threat Modeling, and Design Review 9.3 Secure Coding, Code Review, and Application Testing 9.4 CI/CD, Source Control, and Environment Separation 9.5 Software Supply Chain, Third-Party Components, and Deployment 9.6 DevSecOps Vulnerability Management and Release Risk 9.7 Software Development Security Case Lab

10 Chapter 10: Integrated CISSP Governance Scenario Labs

10.1 Enterprise Risk Committee Decision Lab 10.2 Cloud Migration Security Architecture Lab 10.3 Ransomware Incident and Business Continuity Lab 10.4 Identity Modernization and Zero Trust Lab 10.5 Third-Party Breach and Contract Governance Lab 10.6 Secure SDLC Transformation Lab 10.7 Full CISSP Manager Simulation

11 Chapter 11: Final Review, Endorsement, CPE, and Test-Day Strategy

11.1 Final 45-Day CISSP Study Plan 11.2 CAT Timing and Forward-Only Decision Workflow 11.3 Mixed-Domain Remediation and Manager Mindset Review 11.4 Test-Day Checklist and Pearson VUE Readiness 11.5 Endorsement, Associate Path, and Work Experience Documentation 11.6 CPE, AMF, and Three-Year Maintenance Plan 11.7 CISSP Final Mixed Review

5.3 Segmentation, Microsegmentation, SDN, VPC, and Zero Trust

Key Takeaways Explain This Topic AI

Segmentation limits blast radius by separating systems according to business function, data sensitivity, trust level, and operational dependency.

Microsegmentation moves policy closer to workloads and identities, reducing reliance on coarse perimeter zones.

Software-defined networking and cloud VPC designs make network controls programmable, but they also require governance, change control, and visibility.

Zero trust assumes no implicit trust based on network location and requires continuous verification of identity, device posture, context, and authorization.

Segmentation decisions must balance risk reduction with operational complexity, latency, troubleshooting ability, and business workflow requirements.

Last updated: May 2026

From zones to verified access

Traditional segmentation divides the environment into zones such as internet edge, DMZ, user LAN, server LAN, production, development, management, and restricted data. This still matters because a well-placed boundary can block many unnecessary paths. However, zone names do not automatically create security. The policy between zones, the identity of the source, the sensitivity of the target, and the monitoring around the flow determine whether the boundary reduces risk.

A DMZ is useful when internet-facing systems must interact with internal services without exposing the internal network directly. A payment application might place public web servers in a DMZ, application services in a protected tier, databases in a restricted tier, and administration in a separate management network. The business value is containment: compromise of the public tier should not immediately grant database access or domain administration.

Microsegmentation applies more precise policy at workload, host, container, process, or identity level. Instead of allowing every system in an application subnet to reach every database port, policy can allow only a specific application service identity to reach a specific database listener. This reduces lateral movement and makes unauthorized flows easier to detect. The tradeoff is complexity: poor policy design can break applications or produce exception sprawl.

• Pattern Strength Governance concern
• VLAN or subnet segmentation Familiar and scalable for broad zones Can become too coarse for modern workloads
• Firewall zones Strong inspection and central policy Bottlenecks and rule sprawl if unmanaged
• Microsegmentation Fine-grained lateral movement control Requires accurate asset and flow mapping

Cloud VPC or VNet segmentation Programmable isolation in cloud accounts Misconfiguration can expose services quickly

Zero trust network access Verifies user, device, and context per access Needs identity, device, and policy maturity

SDN, VPC, and zero trust operations

Software-defined networking separates control and data plane functions so policy can be managed through software. In cloud environments, VPCs and VNets provide private address space, route tables, security groups, network ACLs, gateways, private endpoints, and flow logs. These controls are powerful because they can be versioned, reviewed, and deployed as code. They are also risky when teams bypass review or copy permissive templates into production.

Zero trust is not a single product or a synonym for VPN. It is a strategy that removes implicit trust based on location. A user on the office LAN should not automatically have broad application access. A workload in the production VPC should not automatically reach every database. Access decisions should consider identity, device health, workload identity, requested resource, sensitivity, behavior, and current risk signals. Authorization should be least privilege and continuously evaluated.

A practical zero trust network roadmap often starts with visibility. You cannot create durable microsegmentation policy if you do not know which services talk to which dependencies. Flow logs, endpoint telemetry, identity logs, CMDB data, and application owner interviews are used to build an allowlist. The team then enforces policy in stages, beginning with high-value assets and using monitor-only mode when available.

Segmentation design workflow:

Identify critical business services and data stores, including owners and recovery requirements.

Map normal traffic flows, privileged access paths, third-party access, and emergency operations paths.

Define trust boundaries based on data sensitivity, exposure, operational role, and threat model.

Choose controls such as firewall policy, security groups, host firewall, service mesh, private endpoints, or ZTNA.

Test enforcement in phases, monitor blocked flows, and remove temporary exceptions.

Review policy after application changes, mergers, incidents, and cloud account creation.

The leadership issue is sustainable risk reduction. A highly segmented network that nobody understands can fail during an incident. A permissive network that is easy to run can fail during an attack. The CISSP answer is to align segmentation depth with business risk, maintain clear ownership, automate review where possible, and prove through testing that normal and emergency workflows still function.

Segmentation decision checkpoint

Use segmentation depth where it changes risk, not where it merely adds complexity. High-value data stores, privileged administration paths, identity infrastructure, backup systems, and internet-facing workloads usually justify stronger boundaries. Low-risk systems may need simpler controls if strict segmentation would consume scarce operations capacity without meaningful risk reduction. The important point is traceability: every allowed path should have a business purpose, an owner, and enough logging to support incident response.