hardMultiple ChoiceObjective-mapped
350-701 Next-Generation Firewall (NGFW) Practice Question
A financial institution with a flat Layer 2 network has experienced a ransomware incident where an infected workstation in the accounting department propagated laterally to a server in the finance department. The network spans 10 switches connected in a star topology with a collapsed core. The IT team wants to implement segmentation to contain such threats in the future, without requiring major hardware upgrades and with minimal change to IP addressing. The network currently uses a single VLAN with /16 subnet. Which of the following approaches would BEST achieve the segmentation goal, considering the constraints?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement internal firewall zones using a next-generation firewall (NGFW) with application inspection and user identity
Implementing internal firewall zones with a next-generation firewall (NGFW) provides granular, stateful inspection and application-level segmentation. It can filter traffic between departments without changing IP addressing and leverages existing switch infrastructure. VLANs with ACLs on the core router are stateless and can be bypassed; also they require reconfiguring IP addressing if VLANs are separate subnets, and ACLs on a core router do not provide the depth of inspection needed. Deploying a VPN for all internal traffic is not scalable and adds latency. Using STP and PVLANs on switches can provide some isolation but does not prevent lateral movement at higher layers and is complex to manage across multiple switches without a fabric. Option C is the most effective given the constraints.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Spanning Tree Protocol with Private VLANs on all switches
Why it's wrong here
PVLANs provide isolation within a VLAN but require careful configuration and do not prevent lateral movement across different PVLANs if not properly enforced; also STP does not block traffic at Layer 3.
- ✗
Deploy a full-mesh VPN between all departments to encrypt and restrict traffic
Why it's wrong here
IPsec VPNs are not designed for internal segmentation, introduce overhead, and cannot inspect application-layer traffic.
- ✓
Implement internal firewall zones using a next-generation firewall (NGFW) with application inspection and user identity
Why this is correct
An NGFW provides stateful, application-aware segmentation that can enforce micro-segmentation without IP changes and leverage existing VLAN trunking.
- ✗
Deploy VLANs for each department and apply ACLs on the core router to restrict inter-VLAN traffic
Why it's wrong here
This would require IP re-addressing and the core router ACLs are stateless and harder to manage for application-layer threats.
Visual reference
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.