Cyber Security Quiz: Network Segmentation
10 questions · exam conditions
0:00
Network SegmentationQuestion 1 of 10

A company places Finance, Engineering, and Human Resources endpoints in separate VLANs. All VLANs terminate on the same Layer 3 switch. To simplify troubleshooting, the switch has an access control list that permits all traffic between the three VLANs.

Which assessment best describes the effect of this design on the blast radius of a compromised Engineering endpoint?

The blast radius is reduced because VLAN tags prevent an endpoint from sending packets to endpoints in other VLANs.
The blast radius is reduced because routing between VLANs forces malware to cross a Layer 3 rather than Layer 2 boundary.
The blast radius remains broad because the permissive inter-VLAN policy provides reachability to the other endpoint groups.
The blast radius is limited to Engineering because separate broadcast domains also create separate security trust zones.
← Back to quizzes

Cyber Security Quiz

Cyber Security Quiz: Network Segmentation

Practice Network Segmentation in Cyber Security with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Network Segmentation, giving you a quick way to practice the rules, question types, and explanations that matter most for Cyber Security.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

A company places Finance, Engineering, and Human Resources endpoints in separate VLANs. All VLANs terminate on the same Layer 3 switch. To simplify troubleshooting, the switch has an access control list that permits all traffic between the three VLANs.

Which assessment best describes the effect of this design on the blast radius of a compromised Engineering endpoint?

  1. The blast radius is reduced because VLAN tags prevent an endpoint from sending packets to endpoints in other VLANs.
  2. The blast radius is reduced because routing between VLANs forces malware to cross a Layer 3 rather than Layer 2 boundary.
  3. The blast radius remains broad because the permissive inter-VLAN policy provides reachability to the other endpoint groups. (correct answer)
  4. The blast radius is limited to Engineering because separate broadcast domains also create separate security trust zones.
Explanation: When you see a question about network segmentation and security, shift your thinking from how traffic is separated to how traffic is permitted. The real question isn't whether VLANs exist — it's whether the controls between them actually restrict lateral movement. Here, the permissive ACL is the critical detail. Even though Finance, Engineering, and HR live in separate VLANs, the explicit "permit all" policy between them means a compromised Engineering endpoint can freely reach any host in the other VLANs. Segmentation creates the opportunity for access control, but without enforcement, it provides no security benefit. The blast radius — the scope of damage a compromised asset can cause — remains as wide as the reachability the network allows. That makes C correct. A is wrong because VLAN tags are a Layer 2 mechanism for separating broadcast domains, not a security enforcement tool. An attacker routing through the Layer 3 switch crosses VLAN boundaries entirely through normal, permitted traffic flows — tags don't block anything here. B contains a subtle trap: crossing a Layer 3 boundary sounds more secure, but Layer 3 routing is only a security control when combined with filtering. Routing alone without restrictive ACLs adds no meaningful protection against lateral movement. D is the most dangerous distractor. Separate broadcast domains do not automatically equal separate security trust zones. Trust zones require deliberate policy enforcement — the whole problem in this scenario is that no such enforcement exists. The exam pattern to remember: segmentation without restriction is not security. Always ask whether the ACL or firewall policy actually denies unauthorized traffic, not just whether segments exist.

Question 2

Internet-connected cameras are placed in an IoT zone. Each camera must query an internal DNS resolver, synchronize with an internal time server, and download firmware from an update proxy. The cameras do not need to initiate any other internal connections.

Which rule set most effectively limits the blast radius if one camera is compromised?

  1. Allow the IoT zone to initiate traffic to all internal servers, while denying connections initiated from user workstations to cameras.
  2. Allow cameras to reach only the required DNS, time, and update services, then deny other IoT-to-internal traffic. (correct answer)
  3. Allow any internal traffic to or from the IoT zone, but log all camera connections for later incident investigation.
  4. Deny all routed traffic from the IoT zone, including DNS, time synchronization, and firmware-update communications.
Explanation: When you see a question about IoT network security, think blast radius minimization — a core principle of network segmentation. The goal is to contain damage so that if one device is compromised, an attacker can't easily pivot to critical internal systems. The right tool here is the principle of least privilege applied to firewall rules: devices should be permitted only the specific connections they genuinely need. Option B is correct because it does exactly this. Cameras legitimately need DNS resolution, time synchronization, and firmware updates — and nothing else. By explicitly allowing only those three service paths and blocking all other IoT-to-internal traffic, you ensure a compromised camera cannot be used to probe databases, attack workstations, or reach sensitive servers. The attacker's foothold stays trapped in the IoT zone. Option A fails because it only restricts inbound connections from workstations to cameras. It leaves cameras free to initiate connections to any internal resource — a compromised camera could scan and attack internal servers freely. Option C is dangerously permissive. Logging is valuable for forensics, but it does nothing to prevent lateral movement. An attacker doesn't care if their traffic is logged while they're exfiltrating data or pivoting through your network. Option D overcorrects. Denying all routed traffic sounds secure, but it breaks legitimate operations — cameras can't resolve hostnames, sync time, or receive updates, making the solution operationally unworkable. Study tip: On security questions, always distinguish between detection controls (logging) and prevention controls (firewall rules). Detection doesn't limit blast radius — restriction does.

Question 3

Several application clusters use a shared database subnet. Each application legitimately connects to only one designated database, but current firewall rules allow every application server to connect to every database server on the database port.

Which improvement most directly reduces the blast radius of a compromised application server?

  1. Keep the shared rule and deploy stronger database passwords because authentication alone prevents cross-application movement.
  2. Encrypt every application-to-database session while continuing to permit all application and database server combinations.
  3. Move all databases to a new shared subnet while retaining the rule that permits access from every application server.
  4. Allow each application identity or address only to its designated database and required port, denying other pairings. (correct answer)
Explanation: When you see a question about limiting damage from a compromised system, think blast radius — how far an attacker can move laterally if they gain control of one component. The principle at play here is least-privilege network segmentation: each system should communicate only with exactly what it needs, nothing more. The most direct way to shrink blast radius is to enforce granular firewall rules that permit each application server to reach only its designated database on only the required port, denying all other pairings. This is precisely what D does. If an attacker compromises Application Server A, they cannot pivot to Databases B or C because the firewall physically blocks those paths — the damage is contained to one application's data. A is wrong because stronger passwords address authentication, not network reachability. An attacker who already owns the application server process can use the legitimate credentials that application already holds, bypassing password strength entirely. Authentication and network access control solve different problems. B is wrong for a similar reason. Encrypting sessions protects data in transit from eavesdropping, but it does nothing to prevent a compromised server from opening a connection to a database it shouldn't reach. Encryption is about confidentiality, not access restriction. C is a distractor that looks like structural improvement but changes nothing meaningful. Moving databases to a new subnet while keeping the permissive "every app to every DB" rule just relocates the same problem — the overly broad access policy remains intact. The study tip: whenever a question mentions "blast radius" or "lateral movement," your answer should involve restricting reachability, not improving authentication or encryption alone.

Question 4

Administrators manage production servers through a jump host. The jump host has one network interface in the employee network and another in the production management network. Employees may use the jump host for web browsing and email when not performing administrative work.

Which change would best preserve administrative access while reducing the chance that an employee-network compromise reaches the production management network?

  1. Retain both interfaces but install endpoint antivirus and require longer passwords for all jump-host administrator accounts.
  2. Move the jump host into the employee VLAN and permit it to route management traffic directly to production servers.
  3. Create a dedicated management jump host with tightly controlled ingress, restricted egress, and no general-purpose user activity. (correct answer)
  4. Place production servers in separate VLANs but allow the existing jump host unrestricted access to every server VLAN.
Explanation: When you see a question about network segmentation and privileged access, ask yourself: what is the real threat model, and does the proposed control directly address it? Here, the core risk is lateral movement — an attacker who compromises an employee workstation potentially pivoting through the jump host into the production management network. The strongest defense is separation of purpose. A dedicated management jump host (C) has no general-purpose browsing or email, drastically shrinking its attack surface. Tightly controlled ingress means only authorized administrators can connect; restricted egress means the host can't freely reach the internet (limiting malware callbacks or data exfiltration). Because no casual user activity happens on it, the odds that an employee-network threat ever lands on this host drop dramatically. This is the principle of least functionality applied to network architecture. Option A is a classic "security theater" trap — antivirus and stronger passwords don't eliminate the fundamental design flaw that the same host serves both casual and administrative purposes. It treats symptoms, not the cause. Option B makes things actively worse. Collapsing the jump host into the employee VLAN removes the boundary entirely, giving any attacker in that zone a direct path to production management traffic. Option D introduces VLAN segmentation on the production side but leaves the jump host itself unrestricted, meaning a compromised jump host still reaches every server — the segmentation buys almost nothing. Study tip: On security architecture questions, always look for the answer that eliminates the attack path rather than one that just hardens a flawed design. Architectural fixes beat compensating controls.

Question 5

A company normally restricts traffic between user, application, and database zones. During an outage, an engineer adds a temporary rule permitting any protocol from all user subnets to all server subnets. The application begins working, but the rule remains in place after service is restored.

What is the most significant security consequence of leaving the temporary rule enabled?

  1. It increases the blast radius because a compromised user endpoint gains broad reachability to systems across multiple server zones. (correct answer)
  2. It reduces the blast radius because consolidating cross-zone traffic into one rule simplifies firewall management and policy review.
  3. It affects confidentiality only, because network segmentation has no direct influence on malware propagation or lateral movement.
  4. It leaves the blast radius unchanged because user and server systems still use different IP address ranges.
Explanation: Whenever you see a question about firewall rules and network segmentation, anchor your thinking to the concept of blast radius — the scope of damage an attacker can cause from a single compromised device. Segmentation exists precisely to limit that radius by controlling which systems can communicate with which. Here, the company deliberately separated user, application, and database zones to contain potential breaches. The temporary rule tears down that containment by allowing any protocol from all user subnets to all server subnets. If an attacker compromises one user endpoint, they now have broad network-level access to systems across multiple zones — servers, databases, internal applications — without needing to break through additional firewall controls. That explosive expansion of reachability is exactly what A describes, making it correct. The forgetting of this rule is a classic example of "temporary" configurations becoming permanent attack surface. B is wrong because it inverts the logic. Consolidating cross-zone traffic into a permissive rule doesn't simplify security — it destroys it. Broad rules make auditing harder, not easier, and certainly don't reduce blast radius. C is wrong because network segmentation directly influences more than confidentiality. Unrestricted lateral movement enables malware propagation, ransomware spread, and privilege escalation — all integrity and availability concerns, not just confidentiality. D is wrong because different IP ranges provide zero security boundary if a firewall rule explicitly permits traffic between them. IP separation without enforcement is meaningless. A useful study habit: whenever you see "blast radius" in an answer choice, ask yourself whether the scenario expands or shrinks an attacker's reach — that framing will consistently guide you to the right answer.

Question 6

A security team has deployed segmentation gateways between workstation, server, and management zones. Leadership asks for evidence that the controls actually reduce blast radius rather than merely documenting separate address ranges.

Which validation activity provides the strongest evidence that the segmentation is effective?

  1. Confirm that each zone uses a different subnet mask and that network diagrams show a gateway between the zones.
  2. Review switch configurations to verify that every endpoint is assigned to its intended VLAN and access port.
  3. Run controlled attack simulations from each zone and verify that only explicitly approved cross-zone flows succeed. (correct answer)
  4. Compare malware-alert counts before and after deployment and confirm that the total number of alerts decreases.
Explanation: When a question asks for evidence that a control actually works — not just that it exists — your mind should jump to operational validation, not documentation review. Segmentation is meant to contain lateral movement; the only way to prove containment is to attempt the movement and observe what happens. That's exactly why C is the strongest answer. Running controlled attack simulations from each zone — essentially an adversarial test — directly measures whether unauthorized cross-zone traffic is blocked and authorized flows are permitted. This is often called "purple team" or segmentation testing, and it maps to the principle that controls must be verified, not assumed. If an attacker compromised a workstation, could they reach the management zone? Simulation answers that question with empirical data. A falls into the documentation trap. Separate subnets and diagrams showing a gateway tell you the design intent, not whether the gateway is enforcing policy correctly. A misconfigured firewall rule can defeat even a well-drawn architecture diagram. B goes one layer deeper — checking VLAN assignments confirms endpoints are in the right logical segment — but it still doesn't tell you whether traffic is actually being blocked at the segmentation gateway. A device can be in the correct VLAN and still reach zones it shouldn't if ACLs or firewall rules are wrong. D is tempting because it uses real operational data, but a decrease in total alerts is far too indirect. Alerts could drop for unrelated reasons (tuning, sensor failure, lower malware volume), and this metric says nothing specific about cross-zone movement. Study tip: On security exam questions, distinguish between evidence of design (diagrams, configs) and evidence of effectiveness (testing, simulation). Questions about "reducing blast radius" are almost always asking for the latter.

Question 7

A cloud environment places web, application, and database instances in three different subnets within one virtual network. The platform automatically installs a local route that permits traffic among all three subnets. Network security rules currently allow all traffic from the virtual network's address range.

Why does this design provide less blast-radius reduction than the subnet layout appears to provide?

  1. Cloud subnets cannot serve as segmentation boundaries unless every workload uses a publicly routable IP address.
  2. The broad internal rules preserve cross-subnet reachability, so the subnet boundaries do not enforce tier-specific access. (correct answer)
  3. The local route encrypts east-west traffic but does not authenticate the individual application and database instances.
  4. The three subnets are ineffective because segmentation requires each application tier to use a separate cloud provider.
Explanation: When you see a question about cloud network segmentation and "blast radius," you should immediately ask yourself: do the architectural boundaries actually enforce access restrictions, or do they just organize resources visually? Subnets alone don't protect anything — the security controls layered on top of them do. In this scenario, the three-subnet design looks like defense-in-depth, but the network security rules allow all traffic from the entire virtual network address range. That means the web tier can freely reach the database tier directly, the database can reach the web tier, and so on. If an attacker compromises the web servers, they have an open path to the database — the subnet boundary offers no resistance. This is exactly why B is correct: the overly broad inbound rules preserve full cross-subnet reachability, making the subnet layout cosmetic rather than functional. A is wrong because subnets absolutely can act as segmentation boundaries regardless of whether instances use public or private IPs — that's a fabricated requirement with no basis in how cloud networking works. C is wrong because the local route does not encrypt anything; it's simply a routing table entry that tells the network how to forward packets between subnets. Encryption would require something like IPsec or TLS, which is a separate control entirely. D is wrong because multi-tier segmentation does not require separate cloud providers — that's an absurd constraint that confuses physical isolation with logical isolation. As a study tip, remember: segmentation = topology + policy. Subnets provide topology, but without restrictive security group or firewall rules, they enforce nothing. Always evaluate both layers together.

Question 8

A hospital has user workstations, medical imaging devices, application servers, and backup servers on a flat network. Imaging devices must upload studies to one application service, and that service must write completed studies to the backup environment. Security engineers want to limit ransomware propagation without disrupting these workflows.

Which segmentation policy would most directly reduce the ransomware blast radius while preserving the required data flows?

  1. Allow imaging devices to reach all application servers, while blocking direct access from user workstations to the backup servers.
  2. Allow imaging devices to reach only the imaging service, and allow that service to reach only required backup interfaces. (correct answer)
  3. Allow each zone to initiate connections to every other zone, while enabling antivirus inspection on the routed traffic.
  4. Block all traffic between imaging devices and servers, and require administrators to transfer each study using removable media.
Explanation: When you see a question about limiting ransomware spread in a segmented network, think in terms of least-privilege connectivity — every device should only be able to reach exactly what it needs, nothing more. The goal is to shrink the "blast radius," meaning if one device is compromised, the attacker can't pivot freely across the network. The scenario describes two required flows: imaging devices → imaging service, and imaging service → backup environment. A strong segmentation policy maps firewall rules directly onto those two flows and nothing else. That's precisely what B does — it creates a narrow, explicit allowlist that mirrors the legitimate workflows while blocking all lateral movement outside those paths. If ransomware infects an imaging device, it cannot reach backup servers, other application servers, or workstations. A is too permissive on the imaging side — allowing those devices to reach all application servers gives ransomware a much wider attack surface than the workflow requires. Blocking workstations from backup is a partial improvement, but it doesn't address the core exposure. C essentially describes a flat network with antivirus layered on top. Antivirus inspection does not prevent ransomware from propagating over legitimate connections; it only catches known signatures after the fact. Full zone-to-zone connectivity defeats the purpose of segmentation entirely. D eliminates the automated workflows that the hospital depends on, making it operationally unacceptable. Security controls that break critical processes don't get implemented — or get bypassed. Your study tip: when evaluating segmentation answers, mentally trace each required data flow and ask which option permits exactly those flows and nothing else. That's always your target.

Question 9

Remote employees connect through a VPN concentrator and receive addresses from a dedicated VPN pool. A firewall permits the VPN pool to access approved internal applications but blocks direct access to endpoint, server-management, and backup networks. An auditor argues that remote users are not segmented because their traffic uses the same physical core switches as internal traffic.

Which response most accurately evaluates the auditor's claim?

  1. The claim is correct because effective segmentation requires physically separate switches and cabling for each trust zone.
  2. The claim is correct because a VPN provides encryption but cannot participate in internal network segmentation controls.
  3. The claim is incorrect because assigning a separate address pool to remote users automatically prevents all routes to internal resources.
  4. The claim is incorrect because enforced logical policies can segment traffic even when zones share physical infrastructure. (correct answer)
Explanation: When a question asks you to evaluate a claim about network segmentation, focus on the distinction between physical and logical separation — this is one of the most frequently tested concepts in network security architecture. Effective segmentation is defined by enforced policy boundaries, not by whether zones share hardware. In the scenario described, remote users receive a dedicated IP pool, and a firewall actively enforces access rules — permitting only approved application traffic and blocking entire network categories like server-management and backup systems. That firewall-enforced boundary is exactly what segmentation means: traffic is controlled based on source, destination, and policy. Sharing a physical switch does not collapse those boundaries any more than sharing a highway collapses city limits. D is correct because logical policies — access control lists, firewall rules, routing restrictions — can fully segment traffic even across shared physical infrastructure. A reflects a common misconception that segmentation requires physical separation. This was once a practical approach, but modern networks rely on logically enforced zones (VLANs, firewall policies, SDN) as equally valid and widely accepted controls. Requiring separate physical switches for every trust zone would be operationally impractical and is not a security standard. B is wrong because it mischaracterizes VPN functionality — VPNs provide encrypted tunneling and the endpoint of that tunnel (the concentrator) can absolutely feed traffic into segmented, policy-controlled zones. C describes a real mechanism (separate address pools enable policy targeting) but overstates it — an address pool alone does not prevent all routes; the firewall rules do the actual enforcement. Your study tip: when you see the word "segmentation," ask yourself what enforces the boundary — not what it's built on physically.

Question 10

After acquiring another company, an organization connects both corporate networks through a firewall. Business teams require access to one shared file service and one identity service. The acquired network has not yet completed the organization's security-hardening process.

Which initial firewall policy best limits the blast radius of a compromise in the acquired network?

  1. Permit only documented access to the shared services, deny other routes, and expand access after application-flow validation. (correct answer)
  2. Permit all internal protocols between both companies, but block Internet access originating from the acquired network.
  3. Permit all authenticated users to reach both networks because the shared identity service establishes a common trust boundary.
  4. Block access to the shared services, but permit administrative protocols so support personnel can resolve integration problems.
Explanation: When connecting an untrusted or partially hardened network to your own, the guiding principle is least privilege with staged access — start by allowing only what's explicitly needed, then expand carefully after validation. This directly limits the "blast radius," meaning how far an attacker can move laterally if the acquired network is compromised. Option A is the right approach because it enforces a minimal, explicit allowlist: only the two documented services (file and identity) are reachable, everything else is denied, and broader access is only granted after confirming application behavior. This contains any threat originating from the unhardened network to the smallest possible footprint. Option B sounds restrictive but is actually dangerously permissive — blocking Internet access does nothing to prevent lateral movement between the two internal networks. An attacker already inside the acquired network could freely pivot into the main corporate environment using any permitted internal protocol. Option C introduces a false sense of security. A shared identity service establishes authentication, not authorization to everything. Compromised credentials — highly likely in an unhardened environment — would give an attacker free reign across both networks under this policy. Option D gets things backwards. Blocking the shared services denies business functionality while leaving administrative protocols open, which are often high-value attack vectors (think RDP, SSH, WinRM). This trades the wrong tradeoff entirely. Study tip: On security exam questions involving network mergers or segmentation, always ask "what's the minimum access needed right now?" Answers that open broad access for convenience — even with conditions like authentication — are almost always wrong.