What it means
Segmentation can use virtual networks, subnets, routing, security groups, firewalls, service policies, identity-aware controls, and separate accounts or projects.
Why it matters
Because cloud communication can occur through APIs and managed services, subnet boundaries alone may not represent the full trust model.
Practical focus
- Segment according to trust and business function
- Allow only documented communication paths
- Use account and identity boundaries with network controls
- Test actual reachability continuously
Common mistakes
- Creating many subnets without meaningful policy
- Allowing broad internal ranges by default
- Ignoring service-to-service and cross-account paths
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: