CND Practice Question: When designing a secure network perimeter, what is the term used for breaking a large…
When designing a secure network perimeter, what is the term used for breaking a large network into smaller, isolated subnetworks to contain breaches and control lateral movement?
⚠ Common exam trap
The trap is confusing segmentation (isolation for security) with bridging (connecting segments) or fragmentation (packet-level splitting) — candidates who focus on the word 'breaking' may incorrectly pick fragmentation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network Segmentation
Network segmentation is the practice of dividing a large network into smaller, isolated subnetworks (segments) using VLANs, subnets, firewalls, or SDN policies to limit the blast radius of a breach and restrict lateral movement. It is a foundational zero-trust and defense-in-depth control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Network Segmentation
Why this is correct
Network segmentation divides a network into zones, using VLANs and subnets, firewalls, ACLs or microsegmentation, and allows only the traffic each zone needs between them. If one device is compromised, the attacker cannot freely reach everything else, so the damage is contained and lateral movement is slowed and visible at the boundaries. It also reduces compliance scope, for example for PCI DSS.
- ✗
Packet Fragmentation
Why it's wrong here
Packet fragmentation splits IP datagrams to fit a link's MTU; it does not create isolated subnetworks. It is tempting because it also involves dividing traffic into smaller pieces, and would be correct when the question asks how oversized packets are transmitted across a link with a smaller maximum transmission unit.
- ✗
Network Bridging
Why it's wrong here
Bridging connects network segments so they act as one Layer 2 network, forwarding frames between them, which is the opposite of isolating them. It is useful for joining segments, for example with a wireless bridge between buildings, but it increases the area a breach can reach. Containing breaches requires separating segments and controlling traffic between them.
- ✗
Network Flooding
Why it's wrong here
Flooding describes either a switch sending broadcast and unknown frames out of every port, which is normal behaviour, or an attack that overwhelms a target with traffic, a form of denial of service. Neither isolates parts of a network. Breaking a network into isolated zones to limit attackers is segmentation, a core defence-in-depth practice.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
This CND question is part of Courseiva's 311-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CND questions
- An organization is designing a perimeter architecture with two firewalls from different vendors placed in series between…
- A network security engineer needs to configure a Linux-based iptables firewall to drop all incoming TCP packets that hav…
- An organization is hardening its perimeter firewall configuration against reconnaissance and volumetric attacks. Which T…
- Which TWO configuration steps are typically required when deploying a firewall in Transparent (Layer 2) mode rather than…
- An organization is setting up a high-availability perimeter firewall pair. Which protocol is commonly utilized to provid…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.