220-1201 Practice Question: A company's IT policy requires that all network…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable DHCP snooping on the guest VLAN

  Why it's wrong here

  DHCP snooping is a Layer 2 security feature designed to prevent unauthorized (rogue) DHCP servers from issuing IP addresses and to mitigate DHCP starvation attacks. While it enhances network security within a VLAN by validating DHCP messages, it does not provide any mechanism to control or isolate traffic *between* different VLANs. Therefore, it cannot prevent guest VLAN devices from attempting to communicate with the corporate VLAN.

• ✗

  Configure a router-on-a-stick with subinterfaces

  Why it's wrong here

  Configuring a router-on-a-stick with subinterfaces is a common method to enable routing between multiple VLANs using a single physical interface on a router. Each subinterface is configured with an IP address for a specific VLAN, allowing devices in different VLANs to communicate with each other through the router. This setup, by itself, facilitates inter-VLAN routing and communication, which directly contradicts the requirement to isolate traffic between the guest and corporate VLANs.

• ✓

  Implement an ACL that denies traffic from the guest VLAN to the corporate VLAN

  Why this is correct

  An Access Control List (ACL) is a set of rules configured on a router or Layer 3 switch that filters network traffic based on criteria such as source IP address, destination IP address, port number, and protocol. By implementing an ACL that explicitly denies all traffic originating from the guest VLAN's IP subnet and destined for the corporate VLAN's IP subnet, complete isolation is achieved. This ensures that guest devices cannot initiate communication with corporate resources, fulfilling the security policy.

• ✗

  Set the guest network to use a different subnet mask

  Why it's wrong here

  Assigning a different subnet mask to the guest network compared to the corporate network merely defines the local network boundaries for devices within each respective VLAN. While it ensures that devices in different VLANs reside in distinct IP subnets, it does not inherently prevent a router from forwarding traffic between these subnets. Without explicit filtering mechanisms like ACLs, a router configured to route between the VLANs will still permit communication, failing to achieve the required traffic isolation.

Go deeper

Related to this question