Security Architecture and Segmentation
Trust boundaries and segmentation
Architect questions test whether you can place trust boundaries deliberately rather than reactively. Understand segmentation by user role, device type, and function (for example IoT versus corporate versus guest), and the enforcement options: VLANs with ACLs, stateful firewalling, microsegmentation, and identity-based policy. Know the concept of a zero-trust posture: authenticate and authorize every flow, least privilege, and assume breach.
Enforcement points and policy
Be clear about where policy is enforced (access edge, distribution, firewall, controller, endpoint) and the trade-offs: enforcement close to the endpoint is granular but hard to manage; enforcement at a chokepoint is simpler but creates a single point of failure and traffic tromboning. Understand role-based access control with dynamic VLAN or role assignment, guest isolation, and how BYOD/onboarding flows differ from corporate device flows.
Common traps
Questions often bait candidates into treating a VLAN as a security boundary by itself, or assuming encryption replaces authorization. Another trap is forgetting that a stateful firewall must see both directions of a flow, so asymmetric routing breaks policy. Also watch for designs where management plane access is left on the same segment as user traffic.
Worked example
For a new building, enumerate asset classes (corporate laptops, contractor devices, IP cameras, printers, guest Wi-Fi, management interfaces). Assign each a segment, define which segments may reach which services (cameras to NVR only, printers from corporate only), and choose an enforcement point that every flow crosses. If any permitted flow bypasses the enforcement point, the policy is incomplete.