ISC2 CC Network Security Practice Question
A network administrator is planning to segment the network. Which of the following are valid segmentation methods? (Choose TWO)
⚠ Common exam trap
It's easy for candidates to confuse security tools (firewalls, IDS, honeypots) with actual segmentation mechanisms; candidates often pick firewalls because they are associated with network separation, but firewalls enforce policy between segments rather than create them.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Subnetting
Subnetting (A) is a valid segmentation method because it divides a single IP address space into smaller logical networks using subnet masks, creating separate broadcast domains and controlling traffic flow between subnets via routing. VLANs (C) are also valid segmentation methods because they logically partition a physical switch into multiple isolated Layer 2 broadcast domains, typically defined by 802.1Q tagging, allowing separation of devices regardless of physical location. Firewalls (B) enforce security policy between zones but are access-control devices rather than a segmentation technique themselves. IDS (D) monitors and alerts on malicious traffic but does not segment the network, and honeypots (E) are decoy systems used for detection and research, not segmentation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Subnetting
Why this is correct
Subnetting divides a larger IP network into smaller logical subnets using the subnet mask, separating traffic at Layer 3. Each subnet forms its own broadcast domain, giving the administrator a valid method to segment the network.
- ✗
Firewalls
Why it's wrong here
Firewalls filter traffic between zones but do not themselves create the network segments; segmentation requires dividing the network into distinct subnets or VLANs, with firewalls then controlling flows between them. Firewalls are tempting because they enforce the boundaries, but the segmentation method is the subnet or VLAN design.
- ✓
VLANs
Why this is correct
VLANs logically segment a single physical switch infrastructure into isolated broadcast domains, satisfying the requirement to divide the network without additional hardware. Traffic between VLANs requires Layer 3 routing, giving the administrator granular control over inter-segment communication while containing broadcast traffic within each defined group.
- ✗
IDS
Why it's wrong here
An IDS passively inspects mirrored traffic and raises alerts; it cannot partition a network into isolated segments or enforce traffic boundaries between them. It is tempting because IDS is a security control, and segmentation is a security goal, but IDS belongs in a monitoring layer, not as a segmentation mechanism.
- ✗
Honeypots
Why it's wrong here
Honeypots are decoy hosts that lure and observe attackers; they neither divide a network nor restrict traffic flows between zones. They are tempting because they are defensive security infrastructure deployed within a network, but they serve threat detection and deception, not the partitioning function segmentation requires.
Visual reference
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Design
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
IDS
An IDS is a security system that monitors network or system traffic for suspicious activity and alerts administrators to potential threats, but does not actively block them.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.