N10-009 Question 113
Single answerTraffic flows: North-south, East-westA company hosts a customer-facing web application in its data center. Users on the internet connect to a public load balancer, which forwards requests to web servers on an internal subnet. The web servers also communicate with an internal database cluster on another subnet to process transactions. During a security review, the network administrator must classify these traffic patterns correctly before placing monitoring controls. Which option correctly identifies the traffic flows in this environment?
- A
Internet users reaching the load balancer is north-south traffic, and communication between the web servers and database cluster is east-west traffic.
- B
Internet users reaching the load balancer is east-west traffic, and communication between the web servers and database cluster is north-south traffic.
- C
Both traffic flows are north-south because they are part of the same application transaction.
- D
Both traffic flows are east-west because they remain within the company-controlled environment after the session starts.
Show answer and explanation
Correct answer: A
Explanation
North-south traffic describes traffic that enters or exits an environment, such as internet clients accessing a public service or internal users reaching external resources. East-west traffic describes lateral movement within the environment, such as server-to-server, workload-to-workload, or subnet-to-subnet communication. In this scenario, internet users connecting to the public load balancer is north-south traffic because it crosses the network perimeter. The web servers connecting to the database cluster is east-west traffic because it stays within internal network segments. This model aligns with common enterprise security and data center design practices, where perimeter firewalls, proxies, and load balancers often inspect north-south traffic, while internal segmentation firewalls, ACLs, and microsegmentation are used to monitor and restrict east-west traffic. These distinctions are consistent with widely accepted networking and security best practices used in vendor documentation and Network+ objectives covering traffic flow concepts.
- A. Correct.
Correct. North-south traffic refers to traffic entering or leaving the data center, campus, or cloud environment, such as client requests from the internet to a public-facing service. East-west traffic refers to lateral traffic between internal systems, such as application servers communicating with database servers on internal networks. This distinction is important when deciding where to place perimeter controls versus internal segmentation and monitoring.
- B. Incorrect.
Incorrect. This reverses the definitions. East-west traffic is typically lateral movement between internal hosts, subnets, or workloads, while north-south traffic crosses the network boundary between internal resources and external networks such as the internet.
- C. Incorrect.
Incorrect. The fact that both communications support the same application does not make them the same traffic type. Traffic classification is based on flow direction relative to network boundaries and internal segments, not on whether packets belong to one business process.
- D. Incorrect.
Incorrect. Internet-to-load-balancer communication is not east-west because it crosses the organizational perimeter. Only the internal communication between the web tier and database tier is east-west. A common misconception is assuming that once a session reaches an internal service, the entire transaction becomes internal traffic.