An attacker has penetrated a network and is moving into the stage of pivoting throughout the network. Which defense mitigates this stage of the attack?

Unique local administrator passwords (as implemented by LAPS) mitigate pass-the-hash and credential reuse attacks but do not create network-level barriers that block pivoting.

Placing machines that require both internal and external access on two separate network interfaces - with strict firewall rules governing inter-segment traffic - creates enforced boundaries that prevent an attacker from freely traversing the network. This segmentation means that compromising one segment does not automatically grant access to adjacent segments. It directly disrupts the pivoting phase by requiring the attacker to overcome additional controls at each network boundary.

Alerting on suspicious port traffic is a detection control that may trigger a response after pivoting has begun, not a preventive measure that stops the movement itself.

Prioritizing patches on public-facing servers reduces the initial attack surface but does nothing to impede lateral movement once an attacker is already inside the network.