A bank now has a major initiative to virtualize as many servers as possible, due to power and rack space capacity at both data centers. The bank has prioritized by virtualizing older servers first…

Concentrating all web servers in one data center creates a single point of failure and does not address the fundamental security requirement to separate web servers from domain controllers.

Combining web servers and domain controllers into a single shared virtual environment at each data center violates network segmentation principles and exposes internal systems to internet-facing attack vectors.

Separating web servers from domain controllers into distinct virtual environments at each data center enforces network segmentation and limits lateral movement between trust zones. Domain controllers are high-value internal assets that should never share a hypervisor with internet-facing systems, as a compromise of a web server could otherwise allow direct access to authentication infrastructure. Replicating this separation at both data centers also maintains availability and consistent security posture across sites.

Placing all Windows 2000 systems together regardless of role ignores the critical distinction between internet-facing and internal systems and fails to enforce trust-zone separation.