How does segmentation differ from zoning, and when would you apply each?

• A. Segmentation groups assets by department; zoning enforces network addresses only.
• B. Zoning groups assets by trust level; segmentation enforces granular policies to isolate workloads or data flows; apply zoning at high-level boundaries, segmentation within zones.
• C. Segmentation is used only in cloud; zoning only on premises.
• D. Segmentation is for data encryption; zoning for backup strategies.

Answer: (C)

Segmentation and zoning address different kinds of boundaries in a network and data environment. Segmentation is about breaking the environment into smaller, isolated pieces so you can enforce granular policies that limit which workloads and data flows are allowed to intermix. It’s the mechanism you use to control east–west traffic within a boundary, down to individual workloads, services, or data paths.

Zoning, on the other hand, defines higher-level trust boundaries by grouping assets into zones based on their level of trust or their function. Interactions between zones are then governed by perimeter controls or gateways. So zoning sets the broad trust landscape, while segmentation tightens control inside that landscape.

In practice, you apply zoning at high-level boundaries—for example, separating a DMZ, internal, and restricted zones. Inside each zone, you implement segmentation to restrict communications between specific workloads or services, such as isolating the database tier from the application tier or enforcing microsegmentation among microservices.

Segmentation isn’t limited to cloud and zoning isn’t limited to on-premises; both concepts are used across cloud and on-prem environments. The correct view is that segmentation enforces granular isolation of workloads or data paths, and zoning defines higher-level trust boundaries between groups of assets.