easyMultiple SelectObjective-mapped
Network Segmentation Controls: Firewalls and VLANs
A network security team is implementing a defense-in-depth strategy. Which TWO of the following controls are examples of network segmentation? (Choose two.)
Quick Answer
The correct answer is configuring VLANs to separate departmental traffic and implementing firewall rules between internal zones. These are both examples of network segmentation controls because they divide a network into smaller, isolated segments to restrict traffic flow and contain potential threats. VLANs achieve logical separation at Layer 2, allowing different departments to share the same physical switch while remaining isolated from each other, while firewalls enforce segmentation at Layer 3 or above by applying access control lists between security zones like inside, outside, and DMZ. On the ISC2 Certified in Cybersecurity CC exam, this concept tests your understanding of defense-in-depth and lateral movement prevention—a common trap is confusing physical separation (like air gaps) with logical segmentation, but the exam focuses on practical controls like VLANs and firewalls. Remember the mnemonic: “VLANs slice, firewalls dice”—VLANs segment by group, firewalls segment by rule.
⚠ Common exam trap
ISC2 often tests the distinction between segmentation (which actively isolates traffic) and other security controls like monitoring (IDS), placement (DMZ), or encryption (VPN), leading candidates to confuse architectural placement or tunneling with the actual act of segmenting the network.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing firewall rules between internal zones.
Implementing firewall rules between internal zones is a form of network segmentation. By creating distinct security zones (e.g., inside, outside, DMZ) and applying access control lists (ACLs) or stateful firewall policies between them, traffic is restricted to only what is explicitly permitted, thereby isolating network segments and limiting lateral movement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implementing firewall rules between internal zones.
Why this is correct
Firewalls enforce segmentation by controlling traffic between zones.
- ✗
Deploying an intrusion detection system (IDS) on the core switch.
Why it's wrong here
IDS monitors traffic but does not segment the network.
- ✓
Configuring VLANs to separate departmental traffic.
Why this is correct
VLANs create separate broadcast domains, segmenting the network.
- ✗
Placing public-facing servers in a DMZ.
Why it's wrong here
DMZ is a result of segmentation, not the control itself.
- ✗
Using VPN for remote access.
Why it's wrong here
VPN extends the network, it does not segment it.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
DMZ
A DMZ (demilitarized zone) is a network segment that sits between an internal private network and the public internet, hosting publicly accessible services while keeping the internal network isolated.
Key term
Intrusion Prevention System
An Intrusion Prevention System (IPS) is a network security tool that monitors network traffic and actively blocks threats like malware and cyberattacks in real time.
About these practice questions
One of 976 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A helpdesk technician receives a report that a user in the finance department cannot access a shared folder on the server. The same server is accessible from other departments. What is the most likely cause?
easy- A.The server is down
- ✓ B.A firewall rule is blocking traffic from the finance VLAN to the server
- C.The network cable is unplugged
- D.The user's account is disabled
Why B: The scenario describes a user in the finance department unable to access a shared folder on a server that is reachable from other departments. This points to a segmentation or access control issue specific to the finance VLAN. A firewall rule blocking traffic from the finance VLAN to the server is the most likely cause because it would selectively prevent access for that subnet while allowing other VLANs to reach the server, matching the symptom of partial connectivity.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.