Security Architecture →mediumMultiple ChoiceObjective-mapped

SY0-701 Security Architecture Practice Question

In a virtualized environment, several workloads share the same physical host and the same IP subnet. After one payroll VM is compromised, the security team wants to prevent that VM from freely scanning or reaching the other workloads on the host. Which control best addresses this lateral-movement risk?

⚠ Common exam trap

Many candidates confuse subnetting or IP addressing changes (like expanding the subnet mask or using static IPs) with actual network security controls, failing to realize that only policy-based segmentation at the hypervisor or virtual switch layer can block lateral traffic within the same broadcast domain.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Microsegmentation with policy rules applied per workload or per VM

Microsegmentation allows granular security policies to be applied per workload or per VM, even within the same subnet and on the same hypervisor. By enforcing firewall rules at the virtual switch or hypervisor level, it prevents a compromised payroll VM from scanning or communicating laterally with other VMs on the same host, directly addressing the lateral-movement risk.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Microsegmentation with policy rules applied per workload or per VM
Why this is correct
Microsegmentation creates fine-grained trust boundaries between workloads, even when they share the same subnet or host. This limits east-west traffic and reduces the ability of a compromised VM to discover or attack neighboring systems. It is the most direct control for this risk.
✗
Expanding the subnet mask so all workloads are easier to reach
Why it's wrong here
Expanding the subnet mask increases the broadcast domain and the range of IP addresses considered local, but it does not introduce any mechanism to restrict traffic between VMs on the same host; the compromised payroll VM can still freely send packets to any other workload because no network segmentation or microsegmentation is applied. This option is tempting because a larger subnet is often used in flat network designs to simplify routing and reduce the need for inter-VLAN routing, which would be a correct choice if the goal were to eliminate router hops for performance, not to block lateral movement.
✗
Creating a shared administrator account for all virtual machines
Why it's wrong here
Creating a shared administrator account for all VMs drastically increases the blast radius of a single credential compromise: if one workload is breached, the attacker can reuse the same credentials to log in to every other VM, enabling unrestricted lateral movement. It also eliminates non-repudiation because no audit trail can distinguish which administrator performed a given action, and it introduces no traffic filtering or per-workload policy enforcement, so east-west communication between compromised workloads remains completely unhindered.
✗
Disabling DHCP and forcing every VM to use a static IP address
Why it's wrong here
Disabling DHCP and assigning static IPs merely fixes addressing and simplifies inventory tracking; it does not alter the underlying Layer 2 forwarding path on the virtual switch, so VMs can still send packets directly to one another using ARP and static routes. This approach gives an attacker predictable, unchanging target addresses, which actually simplifies reconnaissance and does nothing to restrict the protocols, ports, or identities that determine whether a compromised payroll VM can reach another workload.

Visual reference

Go deeper

SY0-701 Security Architecture Practice Question

Why each option matters

Option-by-option breakdown

Related to this question