AP Cybersecurity topic 3.3
Protecting Networks: Segmentation
Segmentation splits a network into zones so an attacker who gets into one part cannot easily reach the rest. Schools might separate student devices, staff devices, guest Wi-Fi, and servers using VLANs and subnets. A DMZ holds public-facing servers away from the internal network.
Protecting Networks: Segmentation vocabulary
- Segmentation: Dividing a network into separate zones.
- VLAN: A virtual LAN that groups devices logically, regardless of physical location.
- DMZ: A buffer zone for public-facing servers.
- Lateral movement: An attacker moving from one compromised system to others.
AP-style practice questions
Try each one, then open the answer. To save your progress, take this quiz in the interactive course.
1. A hospital wants to make sure infected guest devices cannot reach patient record servers. Which of the following is the best solution?
- (A) Put guest Wi-Fi and patient record servers on separate network segments (VLANs)
- (B) Give guests a longer Wi-Fi password
- (C) Turn off the patient record servers at night
- (D) Put all devices on one large network
Show answer
(A) Put guest Wi-Fi and patient record servers on separate network segments (VLANs) Segmentation keeps untrusted devices away from sensitive systems.
2. Which of the following best explains how network segmentation limits damage after a device is compromised?
- (A) It encrypts every file on the device
- (B) It restricts the adversary's ability to move laterally to other parts of the network
- (C) It removes malware automatically
- (D) It speeds up the internet connection
Show answer
(B) It restricts the adversary's ability to move laterally to other parts of the network Walls between segments slow or stop lateral movement.
3. A company hosts a public website and an internal HR database. Where should the web server be placed?
- (A) On the same segment as the HR database
- (B) In a screened subnet (DMZ) separated from the internal network
- (C) On an employee's laptop
- (D) Outside any firewall with no protection
Show answer
(B) In a screened subnet (DMZ) separated from the internal network A DMZ lets the public reach the web server without giving them a path into the internal network.
Factory network map Segment 1: Office PCs, email Segment 2: Assembly-line controllers Segment 3: Guest Wi-Fi All three segments can freely reach each other.
4. Which of the following is the biggest weakness of this design?
- (A) There are too few segments
- (B) Segments exist but no rules restrict traffic between them
- (C) The guest network has a name
- (D) Office PCs use email
Show answer
(B) Segments exist but no rules restrict traffic between them Segmentation only helps when traffic between segments is controlled.