A regional data center hosts a payroll web application that communicates with a database over...

Option A applies least privilege to the east-west workload flow that must remain available. Zscaler explains that microsegmentation uses identity-based, granular policy so each workload communicates only with resources required for its function, while unauthorized communication is blocked. The payroll server should therefore be permitted to reach the database only on TCP 1433, and unrelated servers should have no path to that database. The wiki should also be separated according to its distinct application identity and access requirements. Placing both applications in a broad segment preserves unnecessary reachability and increases the blast radius; IPS signatures do not replace segmentation. A trusted-network condition addresses user context, not server-to-server authorization. Raising a global user-risk threshold likewise does not constrain the compromised payroll workload’s lateral movement. Identity-based service policy directly contains the threat while preserving the required database flow.