ISC2 CISSP (Certified Information Systems Security Professional)Communication and Network SecurityMedium
A security architect is designing a network for a new high-security research facility. The facility requires strict isolation between different research groups and between research data and administrative traffic, while still utilizing a shared physical network infrastructure. Which of the following network segmentation technologies is most appropriate to meet these requirements efficiently?
- AMultiprotocol Label Switching (MPLS)
- BPhysical network separation
- CVirtual Local Area Networks (VLANs)
- DSubnetting with Access Control Lists (ACLs)
Show answer & explanationAnswer & explanation
Correct answer: C. Virtual Local Area Networks (VLANs)
VLANs allow for logical segmentation of a single physical network into multiple broadcast domains. This provides the necessary isolation between different research groups and administrative traffic while efficiently utilizing shared infrastructure, making it scalable and cost-effective compared to physical separation.
Why the other options are wrong
- A. MPLS is primarily used for efficient data forwarding and traffic engineering in wide area networks, not for logical segmentation within a local network to isolate different user groups or data types.
- B. Physical network separation would provide the strongest isolation but is highly inefficient and costly for a shared physical infrastructure requirement.
- D. Subnetting with ACLs provides some logical segmentation but doesn't create separate broadcast domains as effectively as VLANs on a shared infrastructure, and can become complex to manage for strict isolation.
Virtual Local Area Network (VLAN)
A logical grouping of network devices that allows for segmentation of a single physical network into multiple broadcast domains.
- Improves security by isolating traffic.
- Enhances network performance by reducing broadcast traffic.
- Provides flexibility in network design and management.
- Requires VLAN-aware switches and proper configuration.
Memory trick: Virtual Landscapes Always Network Segments.