GSEC · Question #307
What must be added to VLANs to improve security?
The correct answer is D. Access control lists. Access control lists (ACLs) are applied to VLANs to enforce traffic filtering policies and restrict unauthorized communication between network segments.
Question
What must be added to VLANs to improve security?
Options
- ANetwork hubs
- BAir gaps
- CSpanning tree interfaces
- DAccess control lists
How the community answered
(47 responses)- A2% (1)
- B9% (4)
- C4% (2)
- D85% (40)
Why each option
Access control lists (ACLs) are applied to VLANs to enforce traffic filtering policies and restrict unauthorized communication between network segments.
Network hubs are legacy Layer 1 devices that broadcast all traffic to every connected port, providing no traffic filtering and actually reducing security.
Air gaps are physical disconnections between networks with no logical link, which cannot be added to an existing VLAN configuration as a feature.
Spanning Tree Protocol (STP) prevents Layer 2 switching loops and does not provide any form of access control or traffic filtering.
ACLs define permit and deny rules based on source/destination IP address, port, and protocol, controlling exactly which traffic is allowed to enter or leave a VLAN interface or inter-VLAN routing point. Without ACLs, VLANs provide only logical Layer 2 segmentation but impose no enforcement on the traffic that crosses segment boundaries. Applying ACLs to VLAN interfaces or Layer 3 switch virtual interfaces (SVIs) significantly hardens the network by blocking unauthorized lateral movement.
Concept tested: Securing VLANs with access control lists
Source: https://www.cisco.com/c/en/us/support/docs/ip/access-lists/26448-ACLsamples.html
Topics
Community Discussion
No community discussion yet for this question.