CISSP Communication and Network Security Practice Question
A security team is reviewing network segmentation strategies. Which TWO of the following are benefits of using VLANs? (Select TWO.)
⚠ Common exam trap
Many candidates confuse VLANs with security mechanisms like encryption or firewalls, mistakenly believing VLANs provide confidentiality or replace perimeter defenses, when in fact VLANs only offer logical segmentation at Layer 2.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
They allow logical grouping of devices regardless of physical location
VLANs operate at Layer 2 (Data Link Layer) and allow network administrators to segment devices into distinct broadcast domains based on logical criteria such as department or function, regardless of their physical location on the network. This logical grouping reduces the scope of broadcast traffic because broadcasts are confined to the VLAN, not the entire physical network. By containing broadcasts, VLANs improve network performance and security by limiting unnecessary traffic and isolating potential threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
They provide encryption of network traffic
Why it's wrong here
VLANs operate at Layer 2 (Data Link Layer) of the OSI model, primarily for logical segmentation and the reduction of broadcast domains. They do not incorporate any cryptographic functions to scramble or protect the content of network traffic. Encryption, which secures data confidentiality, is typically handled by higher-layer protocols like IPsec at Layer 3 or TLS/SSL at Layer 4/7, or by dedicated encryption devices.
- ✓
They allow logical grouping of devices regardless of physical location
Why this is correct
VLANs provide the crucial capability to logically segment a network into distinct broadcast domains, irrespective of the physical location of the connected devices. This means that devices belonging to the same logical group or department can be physically distributed across different switches or geographical areas, yet still reside on their dedicated VLAN, simplifying network management and policy enforcement.
- ✓
They can reduce broadcast traffic
Why this is correct
By segmenting a single physical network into multiple distinct virtual LANs, each VLAN effectively becomes its own independent broadcast domain. This fundamental design ensures that broadcast frames originating within one VLAN are strictly confined to that specific VLAN and are not forwarded to other VLANs. Consequently, this significantly reduces the overall broadcast traffic load across the entire network, enhancing performance and efficiency.
- ✗
They eliminate the need for firewalls
Why it's wrong here
VLANs provide Layer 2 segmentation, effectively separating broadcast domains and logically isolating groups of devices. However, they do not inherently inspect, filter, or control traffic between VLANs based on higher-layer protocols, application content, or security policies. Firewalls, operating at Layer 3 and above, remain essential for enforcing granular access control, performing deep packet inspection, and protecting against threats when traffic crosses VLAN boundaries or exits the internal network.
- ✗
They provide inherent protection against ARP spoofing
Why it's wrong here
ARP spoofing is an attack where a malicious actor sends forged ARP messages to associate their MAC address with the IP address of another host or router. Within the same broadcast domain, which is precisely what a VLAN constitutes, devices still rely on ARP for MAC-to-IP resolution, making them vulnerable to such attacks. VLANs do not implement mechanisms like Dynamic ARP Inspection (DAI) or IP Source Guard, which are specifically designed to mitigate ARP spoofing within a VLAN.
Visual reference
Go deeper
Related to this question
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.