SY0-701 Question 196
Single answer3.2 Given a scenario, apply security principles to secure enterprise infrastructure.A company is redesigning its enterprise network after a ransomware incident spread from a compromised user workstation to several internal application servers. The security team wants to reduce the chance that a future endpoint compromise can move laterally into critical systems, while still allowing administrators to manage servers when needed. Which of the following is the BEST approach?
- A
Place user workstations and critical servers in separate VLANs, enforce inter-VLAN traffic through ACLs or a firewall, and require administrators to use a hardened jump server for management access
- B
Disable unused switch ports and enable port security on access switches so unauthorized devices cannot connect to the corporate network
- C
Implement network address translation (NAT) between internal subnets so compromised hosts cannot discover or reach server IP addresses directly
- D
Move critical servers to the same subnet as IT administrators' workstations and protect access using host-based antivirus and strong passwords
Show answer and explanation
Correct answer: A
Explanation
The best answer is to segment user and server networks and strictly control traffic between them, while using a hardened jump server for administrative access. This aligns with widely accepted enterprise security practices such as network segmentation, defense in depth, least privilege, and administrative isolation. Security guidance from sources such as NIST SP 800-41 on firewalls and policy enforcement, NIST SP 800-125B on securing virtualized network functions and segmentation concepts, and CISA guidance on reducing lateral movement consistently emphasizes restricting east-west traffic and isolating management functions. After ransomware or other endpoint compromise, flat networks commonly allow attackers to pivot to high-value assets. VLANs alone are not sufficient unless paired with ACLs or firewall rules that permit only required traffic. A jump server improves accountability, logging, and hardening of privileged access, reducing the risk created by direct administration from user endpoints.
- A. Correct.
Correct. This applies core infrastructure security principles: segmentation, least privilege, and controlled administrative access. Separating user and server networks into different VLANs limits broadcast domains and provides logical isolation. Requiring traffic between those segments to pass through ACLs or a firewall enables policy enforcement and restricts unnecessary east-west communication, which is a key control against lateral movement. Using a hardened jump server or bastion host further reduces exposure by centralizing and monitoring administrative access rather than allowing direct management from general-purpose user systems.
- B. Incorrect.
Incorrect. Disabling unused ports and enabling port security are valuable Layer 2 hardening measures, but they primarily address unauthorized physical connections and some local access threats. They do not adequately solve the scenario's main problem: a legitimate but compromised workstation moving laterally to internal servers over allowed network paths. This is a good supporting control, not the best primary control for limiting workstation-to-server propagation.
- C. Incorrect.
Incorrect. NAT is not a security boundary for internal segmentation and does not inherently prevent lateral movement. Hosts can still communicate if routing and policy permit it, and internal NAT adds complexity without providing the granular access control needed in this scenario. A common misconception is that hiding IP addresses with NAT meaningfully secures internal networks; in practice, segmentation and filtering are the relevant controls.
- D. Incorrect.
Incorrect. Placing critical servers on the same subnet as administrator workstations weakens isolation and increases the attack surface. If an administrator workstation is compromised, the attacker may gain easier Layer 2 or same-segment access to critical systems. Host-based antivirus and strong passwords are important, but they do not replace network segmentation and controlled management paths. This option conflicts with defense-in-depth and least privilege.