Explain the difference between network segmentation, micro-segmentation, and zero trust, and why they matter in security operations.

• A. Network segmentation partitions networks into zones; micro-segmentation isolates workloads at a fine granularity; zero trust requires verification for every access request regardless of network location. Together they limit blast radius and lateral movement.
• B. They are all the same concept and can be used interchangeably.
• C. These concepts apply only to cloud environments.
• D. They are outdated controls replaced by next-generation firewalls.

Answer: (A)

These concepts show how controlling access and movement within a network reduces risk. Network segmentation divides the network into larger zones or segments, creating boundaries that limit how traffic can flow between parts of the environment. Micro-segmentation takes that a step further by enforcing policies at a very fine granularity, isolating individual workloads or services so that even within a segment, communication is tightly controlled. Zero trust changes the mindset: it assumes nothing is trusted by default, requiring verification, authorization, and often encryption for every access request regardless of where it originates or what network location it’s in.

Together, they provide a layered defense. Segmentation creates broad boundaries to slow or halt widespread spread. Micro-segmentation enforces strict, workload-level controls to prevent lateral movement inside those boundaries. Zero trust adds continuous verification and least-privilege access, so there’s no automatic trust granted to users or devices even if they’re inside the network. This combination matters in security operations because it limits blast radius, contains breaches more effectively, and makes enforcement and monitoring more precise and scalable.

The other statements don’t fit as well because they treat these as identical concepts, limit them to cloud environments, or view them as outdated in favor of other controls; in reality, they are distinct approaches that apply across on-prem and cloud, and they remain foundational to modern defense strategies.