350-201 Question 77
Select 3You are a security administrator tasked with segmenting a corporate network to reduce the attack surface and limit lateral movement of potential threats. The network includes critical application servers, employee workstations, IoT devices, and guest Wi-Fi. Which of the following segmentation methods would be most appropriate for achieving this goal?
- A
Use VLANs to separate employee workstations, IoT devices, and guest Wi-Fi into distinct network segments.
- B
Implement a firewall with access control policies between critical application servers and the rest of the network.
- C
Place all devices on the same subnet to simplify management and monitoring.
- D
Use microsegmentation to enforce policies at the workload or application level within the data center.
- E
Disable unused ports on network switches to prevent unauthorized access.
Show answer and explanation
Correct answers: A, B, D
Explanation
Network segmentation is a critical component of a robust cybersecurity strategy. VLANs and firewalls are foundational tools for isolating traffic and securing critical resources, while microsegmentation provides advanced, granular control to minimize the attack surface within the data center. Combining these techniques allows for a layered defense approach, reducing the risk of lateral movement and containing potential threats.
- A. Correct.
Using VLANs to separate different types of devices is a fundamental network segmentation technique that helps isolate traffic and reduce the risk of threats spreading across different device groups.
- B. Correct.
Implementing a firewall with access control policies ensures that critical application servers are protected by restricting unnecessary or unauthorized communication from other parts of the network.
- C. Incorrect.
Placing all devices on the same subnet eliminates segmentation, increasing the risk of lateral movement and making it easier for attackers to access resources once a breach occurs.
- D. Correct.
Microsegmentation takes segmentation to a granular level, enforcing security policies at the workload or application level, which is especially useful in protecting sensitive data within the data center.
- E. Incorrect.
Disabling unused ports enhances security by preventing unauthorized access but does not directly contribute to network segmentation.