712-50 Question 303
Single answerUnderstand the concept of network segmentationA multinational retailer is redesigning its network after a ransomware incident spread from a user workstation to payment-processing systems and several back-office servers. The CISO wants to reduce the blast radius of future compromises without disrupting business operations. The current proposal includes placing point-of-sale (POS) systems, corporate user devices, development servers, and third-party vendor access on separate network segments, with traffic between segments allowed only through firewalls using explicit allow rules. Which approach best demonstrates effective network segmentation for this objective?
- A
Create separate security zones for POS, corporate users, development, and vendor access, enforce least-privilege rules between zones, and restrict east-west traffic to only required applications and ports
- B
Place all internal systems behind the same internal firewall, but strengthen endpoint antivirus and EDR so malware can be detected before it spreads
- C
Move the POS environment to a different IP address range while keeping unrestricted routing between all internal networks to avoid operational issues
- D
Use a single flat network internally, but require multifactor authentication for administrators who access sensitive systems
Show answer and explanation
Correct answer: A
Explanation
The best answer is the one that applies segmentation as a preventive architectural control rather than treating it as simple addressing or relying solely on endpoint and identity protections. In practice, effective segmentation means grouping assets by sensitivity and function, defining trust boundaries, and allowing only justified communications between segments through firewalls, ACLs, or equivalent enforcement points. This reduces lateral movement, contains incidents, and supports resilience. Industry guidance such as NIST SP 800-41 on firewalls and firewall policy, NIST SP 800-125 on networked environments, and PCI DSS requirements around isolating the cardholder data environment all support segmentation with explicit traffic controls. For a CISO, the key decision is balancing operational needs with risk reduction by implementing least-privilege inter-segment access instead of maintaining a flat network.
- A. Correct.
Correct. Effective network segmentation creates distinct trust zones based on business function and risk, then controls communications between them with explicit policy enforcement. Separating POS, user endpoints, development systems, and vendor access limits lateral movement and reduces the impact of a compromise. Restricting east-west traffic to only necessary ports and applications reflects least privilege and is consistent with common security architecture guidance and PCI DSS expectations for isolating the cardholder data environment.
- B. Incorrect.
Incorrect. Endpoint antivirus and EDR are important detective and response controls, but they do not replace segmentation. A flat internal network still allows an attacker or malware more opportunities for lateral movement if endpoint controls fail or are bypassed. This option reflects the misconception that strong endpoint security alone can compensate for poor network architecture.
- C. Incorrect.
Incorrect. Changing IP ranges without enforcing traffic controls is not meaningful segmentation. If unrestricted routing remains in place, systems are still effectively on a flat trust model from a security perspective. This is a common misunderstanding: logical separation by addressing alone does not reduce attack paths unless policy enforcement restricts communications.
- D. Incorrect.
Incorrect. Multifactor authentication for administrators improves identity security, but it does not address the broader risk of malware or unauthorized lateral movement among systems. Network segmentation is about limiting connectivity and trust relationships across network zones, not just strengthening privileged access.