What technique specifically helps limit lateral movement by isolating workloads in zero-trust architecture?

• A. Centralized trust zone
• B. Broad network segmentation
• C. Perimeter-based firewall with wide allowances
• D. Micro-segmentation with strict access controls

Answer: (D)

Limiting lateral movement in zero-trust is achieved through micro-segmentation, which isolates workloads into small, enforceable segments and applies strict access controls. By enforcing explicit authorization for every connection between workloads—based on identity, device posture, role, context, and the principle of least privilege—each workload only communicates with what is truly needed. This containment means compromised credentials or a single breached workload can’t easily spread to others, because inter-workload traffic is blocked unless a finely tuned policy allows it.

In contrast, broader segmentation or a perimeter firewall with wide allowances assumes trust inside the boundary and still risks lateral movement if internal controls aren’t granular enough. A centralized trust zone introduces a single, centralized point of trust and doesn’t provide fine-grained isolation between individual workloads. Micro-segmentation delivers the precise isolation and access control that zero-trust relies on to limit movement within the environment.