SY0-701 Question 166
Single answerLogical segmentationA company is preparing for a PCI DSS assessment. The cardholder data environment (CDE) currently shares the same flat internal network as employee workstations, printers, and development servers. Security logs show several cases in which malware on a user laptop scanned systems that should not have been reachable. The security administrator must reduce the attack surface quickly without replacing existing switches and routers. Which solution BEST addresses this requirement using logical segmentation?
- A
Create separate VLANs for the CDE, user workstations, printers, and development systems, and enforce access between them with ACLs or firewall rules
- B
Replace all copper cabling with fiber to prevent malware from moving between systems on the network
- C
Enable port security on access switches to limit the number of MAC addresses per port
- D
Deploy a load balancer in front of the CDE servers to distribute traffic more securely
Show answer and explanation
Correct answer: A
Explanation
The best answer is to implement logical segmentation with VLANs and then strictly control inter-VLAN communication using ACLs or firewall rules. In Security+ terms, logical segmentation separates systems into security zones without requiring separate physical switches for each group. This is especially relevant for sensitive environments such as PCI DSS cardholder data environments, where segmentation is a recognized method to reduce scope and limit exposure. Practically, placing user workstations, printers, development systems, and CDE assets into separate VLANs helps contain malware, reduce broadcast domains, and enforce least privilege access. However, VLANs alone are not sufficient if unrestricted routing exists between them; policy enforcement through ACLs or internal firewalls is what makes the segmentation effective. This aligns with common vendor and standards guidance, including PCI DSS scoping guidance and general network security best practices from organizations such as NIST, which emphasize network segmentation and controlled communications to limit lateral movement and protect high-value assets.
- A. Correct.
Correct. Logical segmentation is commonly implemented with VLANs, VRFs, and filtering controls such as ACLs or internal firewalls. Separating the CDE from user, printer, and development networks reduces unnecessary connectivity and limits lateral movement. This directly addresses the scenario's need to reduce the attack surface without replacing physical infrastructure.
- B. Incorrect.
Incorrect. Fiber cabling may provide benefits related to distance, bandwidth, or resistance to some forms of electromagnetic interference, but it does not logically segment traffic or stop malware-driven scanning between systems that remain on the same routed or switched network. This distractor reflects a misunderstanding between physical media changes and network segmentation.
- C. Incorrect.
Incorrect. Port security can help prevent unauthorized devices or rogue switches from connecting to an access port by restricting MAC addresses, but it does not create separate trust zones or meaningfully segment the CDE from other internal resources. It is a useful control, but it does not solve the main issue in this scenario.
- D. Incorrect.
Incorrect. A load balancer can improve availability and application distribution, but it is not a primary segmentation control for isolating sensitive systems from general user networks. The CDE would still need network separation and policy enforcement to prevent inappropriate access and lateral movement.