easyMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: A small company has a single flat network with no…
A small company has a single flat network with no segmentation. They recently experienced a malware outbreak that spread quickly across all devices. The IT manager wants to implement network segmentation to contain future outbreaks with minimal cost and complexity. The company currently has a single switch and a router/firewall appliance. The network consists of three departments: Sales, HR, and Engineering. After analyzing the requirements, what is the best course of action?
⚠ Common exam trap
ISC2 often tests the misconception that adding a firewall or security appliance alone provides segmentation, when in fact segmentation requires separating Layer 2 broadcast domains (via VLANs or physical separation) before applying access controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Replace the single switch with multiple managed switches and create VLANs for each department, then connect them to the firewall
VLANs logically segment the flat network into separate broadcast domains for Sales, HR, and Engineering, containing malware spread at Layer 2. Using multiple managed switches with VLANs and trunking to the firewall allows inter-VLAN traffic to be inspected and controlled by the firewall, providing segmentation with minimal cost and complexity. This approach leverages existing hardware (router/firewall) and avoids the expense of additional appliances.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a next-generation firewall between the switch and the router to inspect traffic
Why it's wrong here
This adds perimeter security but does not segment the internal network.
- ✓
Replace the single switch with multiple managed switches and create VLANs for each department, then connect them to the firewall
Why this is correct
This provides logical segmentation using VLANs, containing outbreaks.
- ✗
Implement 802.1X authentication on the switch to control device access
Why it's wrong here
802.1X authenticates devices but does not segment traffic between departments.
- ✗
Install host-based firewalls on all endpoints
Why it's wrong here
Host firewalls protect individual devices but do not prevent lateral movement across the network.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Security Foundations
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
VLAN
A VLAN (Virtual Local Area Network) is a logical grouping of network devices that behave as if they are on the same physical network segment, regardless of their actual physical location.
About these practice questions
One of 976 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.