VLANs and ACLs to Prevent Lateral Movement
A hospital has clinical workstations, badge readers, and building cameras all connected to the same switching infrastructure. After a workstation infection, the security team wants to prevent those endpoints from laterally reaching the badge readers while still allowing the cameras to report to a recording server. What should be implemented first?
Quick Answer
The answer is to create separate VLANs and apply ACLs between device groups based on business need. This works because VLANs segment the network into isolated broadcast domains at Layer 2, preventing infected workstations from directly reaching badge readers, while ACLs enforce granular Layer 3/4 traffic control between those VLANs—allowing only the cameras to communicate with the recording server. On the Security+ SY0-701 exam, this scenario tests your understanding of network segmentation as a foundational defense against lateral movement, often appearing in questions about IoT or mixed-device environments. A common trap is to jump straight to host-based firewalls or patching, but the first step must be logical separation at the switch level. Remember the mnemonic: **VLANs block the path, ACLs guard the gate**—always segment before you filter.
⚠ Common exam trap
The trap here is that candidates often overlook the need for Layer 2 segmentation (VLANs) as a prerequisite for Layer 3/4 ACLs, mistakenly thinking ACLs alone on a flat network can block lateral movement between devices in the same subnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create separate VLANs and apply ACLs between device groups based on business need.
Creating separate VLANs segments the network into distinct broadcast domains, preventing workstations from directly reaching badge readers at Layer 2. Applying ACLs between VLANs then enforces granular access control, allowing only the cameras to communicate with the recording server while blocking lateral movement from infected endpoints. This aligns with the principle of least privilege and is the foundational step for network segmentation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create separate VLANs and apply ACLs between device groups based on business need.
Why this is correct
Separate VLANs establish different trust zones, and ACLs limit only the necessary traffic between them.
- ✗
Increase the DHCP lease time so devices keep the same IP addresses longer.
Why it's wrong here
Longer leases improve address stability but do not reduce lateral movement or isolate compromised endpoints.
- ✗
Replace the switches with unmanaged models to simplify configuration.
Why it's wrong here
Unmanaged switches remove security controls and make segmentation and policy enforcement much harder.
- ✗
Disable the cameras' encryption so the recording server can process traffic faster.
Why it's wrong here
Removing encryption weakens confidentiality and does nothing to stop infected workstations from reaching other systems.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Network segmentation
Network segmentation is the practice of dividing a computer network into smaller, isolated parts to improve performance, contain security threats, and simplify management.
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A manufacturing floor uses barcode scanners and a kiosk terminal that cannot support full endpoint agents or frequent manual patching. USB storage has previously introduced malware, and the devices only need to run one approved application and reach a backend system. Which two controls best reduce risk while preserving function? Select two.
hard- ✓ A.Isolate the scanners and kiosk terminal on a dedicated VLAN that allows only the required backend ports.
- B.Place the devices on the user VLAN so patching and support tools can reach them easily.
- ✓ C.Enforce kiosk mode or application allowlisting so only the approved application can run.
- D.Allow USB storage so updates can be installed manually whenever needed.
- E.Use local administrator accounts with shared passwords to reduce support calls.
Why A: Option A isolates the devices on a dedicated VLAN with strict ACLs, limiting lateral movement and restricting traffic to only the required backend ports, which preserves function while reducing risk. Option C enforces kiosk mode or application allowlisting, ensuring that only the approved application can run, which mitigates the risk of malicious executables (including those introduced via USB) without requiring frequent patching or full endpoint agents. Together, these controls reduce the attack surface and contain potential malware. Options B, D, and E increase risk or do not preserve function properly.
Variation 2. Based on the exhibit, which network change best isolates finance workstations from general user PCs while still allowing printing and application access? VLAN table: - VLAN 20 Users: 10.20.20.0/24 - VLAN 30 Finance: 10.20.30.0/24 - VLAN 40 Printers: 10.20.40.0/24 - VLAN 50 Accounting App: 10.20.50.0/24 Current SVI routing policy: permit ip any any Management goal: Finance devices must not initiate traffic to User VLAN 20, but they must be able to print and access the accounting application.
medium- A.Put finance workstations on the same VLAN as the printers to simplify access.
- ✓ B.Add inter-VLAN ACLs that deny Finance VLAN access to User VLAN 20 while permitting Finance VLAN traffic to VLAN 40 and VLAN 50.
- C.Remove routing between all VLANs and let users print through email attachments.
- D.Place the accounting application in the User VLAN so finance devices no longer need segmentation.
Why B: It uses inter-VLAN ACLs to enforce the principle of least privilege: denying traffic from the Finance VLAN (10.20.30.0/24) to the User VLAN (10.20.20.0/24) while explicitly permitting traffic to the Printer VLAN (10.20.40.0/24) and the Accounting App VLAN (10.20.50.0/24). This preserves the required segmentation and still allows the necessary services (printing and application access) without altering the existing VLAN structure or routing policy.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.