ISC2 CC Network Security Practice Question
A small accounting firm wants to let guests connect to the internet in its lobby without exposing the internal file server or the payroll system. The network administrator is told to add a separate wireless network that uses different IP addressing and cannot route to internal resources. Which security principle is the administrator primarily applying?
⚠ Common exam trap
It's easy for candidates to confuse an access-control principle like least privilege with the network design control that actually isolates guest traffic from internal subnets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network segmentation
Separating guest wireless onto distinct IP addressing and preventing routes to internal systems is a segmentation control. Segmentation confines untrusted devices to a limited network zone, so a compromised guest endpoint cannot directly reach the payroll system or file server. The other concepts address data remnants, proof of actions, or user permissions, none of which create the required network boundary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data remanence
Why it's wrong here
Data remanence concerns residual data left on storage media after deletion or repurposing, which is a media-sanitization issue. It has no bearing on separating guest wireless traffic from internal servers. Applying remanence controls would not prevent a guest laptop from routing to the payroll system, so it fails the scenario.
- ✓
Network segmentation
Why this is correct
Segmenting the guest wireless onto separate IP addressing and blocking routes to internal systems isolates untrusted traffic from sensitive resources. This is a core network security control that limits the blast radius if a guest device is compromised. It directly implements the requirement that guests reach only the internet, not the file server or payroll system.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation ensures a party cannot deny having performed an action, typically through digital signatures or tamper-evident logs. It does not restrict network reachability or isolate guest traffic. Even perfect non-repudiation would still allow a guest device to connect to the file server, so it does not satisfy the stated goal.
- ✗
Least privilege
Why it's wrong here
Least privilege limits user or process rights to only what is required for a task. While conceptually related to access control, it does not by itself create a separate guest network or prevent routing between subnets. The scenario specifically requires network-level separation of guest traffic, which is a segmentation control rather than an account-permission control.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.