easyMultiple ChoiceObjective-mapped
CISSP Practice Question: A small company with 50 employees operates a flat…
A small company with 50 employees operates a flat network where all workstations, servers, and printers are on a single subnet without segmentation. The company recently suffered a ransomware outbreak that spread rapidly from an infected workstation to the file server and multiple other machines, causing significant downtime. The IT manager wants to redesign the network to contain future outbreaks and limit lateral movement. The budget is limited, and the environment uses a mixture of managed and unmanaged switches. Which course of action would BEST mitigate the risk of lateral spread while minimizing cost and complexity?
⚠ Common exam trap
Many exam-takers choose endpoint-focused solutions (like antivirus or encryption) because they seem directly related to malware, but the question specifically targets lateral movement containment, which requires network segmentation, not just endpoint protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement VLANs with ACLs to separate departments and restrict traffic between them.
Implementing VLANs with ACLs segments the flat network into separate broadcast domains, preventing lateral movement by restricting traffic between departments at Layer 2. This directly contains ransomware propagation without requiring new hardware, as VLANs can be configured on existing managed switches, making it cost-effective. ACLs further enforce least-privilege access between VLANs, blocking unauthorized inter-VLAN communication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement VLANs with ACLs to separate departments and restrict traffic between them.
Why this is correct
Implementing VLANs logically segments the flat network into distinct broadcast domains, effectively separating departments. Access Control Lists (ACLs) are then applied to inter-VLAN routing interfaces, such as on a Layer 3 switch or firewall, to strictly control and restrict traffic flow between these segments. This prevents unauthorized lateral movement of threats, ensuring that a compromise in one department cannot easily spread to others, thereby containing potential outbreaks.
- ✗
Enable full-disk encryption on all endpoints and servers.
Why it's wrong here
Enabling full-disk encryption (FDE) protects data confidentiality by encrypting information stored on a device's hard drive, primarily safeguarding against data theft if the device is lost or stolen. However, FDE operates at the storage layer and does not prevent active malware or an attacker from moving laterally across a live network. It offers no defense against network-based attacks or the spread of malware between active, running systems within a flat network.
- ✗
Upgrade all endpoint antivirus to the latest version and enable real-time scanning.
Why it's wrong here
Upgrading antivirus software and enabling real-time scanning enhances endpoint protection against known malware signatures and some behavioral anomalies. While crucial for individual device security, antivirus primarily acts as a reactive measure on endpoints and does not inherently segment the network. It cannot prevent a zero-day exploit or sophisticated, fast-spreading ransomware from bypassing its defenses and moving laterally across an unsegmented network, as its focus is on detection rather than network containment.
- ✗
Deploy a network-based intrusion detection system (IDS) to alert on suspicious traffic.
Why it's wrong here
Deploying a network-based Intrusion Detection System (IDS) provides valuable visibility by monitoring network traffic for suspicious patterns or known attack signatures and generating alerts. However, an IDS is a passive monitoring tool; it only detects and notifies security personnel of potential threats. It does not actively block or prevent malicious traffic from propagating across the network, meaning an outbreak or an attacker's lateral movement can still occur and spread even after being detected.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.