SY0-701 Question 197
Single answer3.2 Given a scenario, apply security principles to secure enterprise infrastructure.A company is redesigning its enterprise network after a ransomware incident spread from a compromised user workstation to several internal application servers. The security team wants to reduce the likelihood of lateral movement while still allowing employees to access public web services, internal business applications, and administrative systems. Which of the following should the company implement FIRST to best support this goal?
- A
Segment the network into security zones and enforce access with internal firewalls and ACLs
- B
Deploy a larger perimeter firewall with higher throughput at the internet edge
- C
Disable all remote administrative access for infrastructure devices
- D
Require all employees to use a VPN before accessing any internal resource from the office
Show answer and explanation
Correct answer: A
Explanation
The best answer is to segment the network into security zones and enforce traffic restrictions between them. In Security+ terms, this applies the principle of securing enterprise infrastructure through segmentation, isolation, and least privilege. When workstations, application servers, management networks, and other sensitive resources are separated, compromise of one segment is less likely to result in full-environment exposure. Internal firewalls, ACLs, and similar controls can be used to allow only required communications between segments. This approach aligns with well-established best practices from sources such as NIST guidance on network security architectures and zero trust concepts, which emphasize minimizing implicit trust and limiting lateral movement. A perimeter firewall, VPN usage, or broad administrative restrictions may still be useful controls, but they do not address the core issue in this scenario as effectively as internal segmentation.
- A. Correct.
Correct. Network segmentation is a core enterprise infrastructure security principle used to limit east-west traffic and reduce the blast radius of a compromise. Placing user workstations, application servers, and administrative systems into separate security zones or VLANs and controlling traffic between them with internal firewalls, ACLs, or similar policy enforcement mechanisms helps prevent an attacker or malware from moving freely across the environment. This directly addresses the scenario's concern about lateral movement after an initial workstation compromise.
- B. Incorrect.
Incorrect. A stronger perimeter firewall can improve north-south traffic inspection at the internet boundary, but it does little to stop ransomware or an attacker from moving between internal systems after a user workstation is already compromised. The scenario specifically highlights internal spread, so focusing only on the edge does not address the primary risk.
- C. Incorrect.
Incorrect. Restricting remote administrative access can reduce attack surface, but disabling all remote administration is not a practical or targeted first step for this scenario. Administrators often require secure remote management using hardened jump hosts, MFA, and network restrictions. The main issue described is uncontrolled lateral movement between enterprise systems, which segmentation addresses more directly.
- D. Incorrect.
Incorrect. VPNs are primarily used to protect remote access over untrusted networks. Requiring office users already on the internal corporate network to use a VPN would add complexity without meaningfully addressing the lack of internal separation that allowed the ransomware to spread. This option reflects a common misconception that encryption alone solves segmentation problems.