Pete, a security administrator, is informed that people from the HR department should not have access to the accounting department's server, and the accounting department should not have access to…

The correct answer is B. VLANs. VLANs (Virtual Local Area Networks) (Option B) logically segment a network at Layer 2, even when devices share the same physical switches. By placing HR and Accounting on separate VLANs, traffic between them is isolated by default - hosts on one VLAN cannot communicate with…

Security architecture

Question

Pete, a security administrator, is informed that people from the HR department should not have access to the accounting department's server, and the accounting department should not have access to the HR department's server. The network is separated by switches. Which of the following is designed to keep the HR department users from accessing the accounting department's server and vice-versa?

Options

AACLs
BVLANs
CDMZs
DNATS

How the community answered

(40 responses)

A
5% (2)
B
93% (37)
D
3% (1)

Explanation

VLANs (Virtual Local Area Networks) (Option B) logically segment a network at Layer 2, even when devices share the same physical switches. By placing HR and Accounting on separate VLANs, traffic between them is isolated by default - hosts on one VLAN cannot communicate with hosts on another VLAN without routing through a device (like a firewall or router) that can enforce additional controls. Option A (ACLs) can enforce access restrictions but typically operate at Layer 3 and are not the primary tool for switch-based segmentation. Option C (DMZ) is a perimeter zone for publicly accessible services, not internal department segregation. Option D (NAT) translates IP addresses and does not provide network segmentation. VLANs are the correct switch-based segmentation solution.

Topics

#VLAN#network segmentation#access control#network isolation

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice