What is true of security as it relates to cloud network infrastructure?

Applying firewalls per-network is too coarse-grained and does not provide workload-level segmentation, leaving lateral movement paths open within a network.

Cloud firewalls operate differently from on-premises firewalls, and replicating on-prem rules ignores cloud-native capabilities and the shared responsibility model.

Opening all traffic within a subnet reduces security by enabling unchecked lateral movement and violates least-privilege principles if one workload is compromised.

A default allow posture exposes all workloads to unnecessary traffic by default - the correct approach is default deny with explicit allow rules.

A default deny policy ensures that all traffic is blocked unless explicitly permitted, which aligns with the principle of least privilege. This prevents unauthorized lateral movement and limits the blast radius of a compromise. Cloud-native firewall rules should begin from a zero-trust baseline and explicitly allow only required traffic flows.