Segmentation and Access Control

Question 1 of 6

A security architect is designing a network for an organization that processes credit card payments. The architect creates a dedicated VLAN for point-of-sale terminals, payment servers, and the payment database — completely isolated from the corporate employee network. Which THREE benefits does this segmentation primarily provide?

Eliminates the need for antivirus software on payment systems, reduces firewall costs, and provides full encryption of all payment data. Prevents a compromised employee workstation from directly reaching payment systems, limits PCI-DSS audit scope to the payment VLAN only, and simplifies change control by containing configuration changes to the payment segment. Prevents all malware from entering the network, eliminates the need for access control lists, and makes all payment traffic encrypted by default. Allows payment servers to run without patching, isolates employee traffic from external threats, and automatically satisfies all PCI-DSS requirements without additional controls.

Question 2 of 6

An access control list on a network device contains the following rules in order: (1) DENY src:192.168.1.0/24 dst:ANY port:ANY; (2) PERMIT src:192.168.1.50 dst:10.0.0.1 port:22. An administrator with IP 192.168.1.50 applies this ACL and immediately loses SSH access to the device at 10.0.0.1. What is the cause?

The administrator's IP address is not in the correct format for an ACL rule, causing both rules to fail silently. ACL rules use first-match evaluation. Rule 1 matches the administrator's traffic (192.168.1.50 is within 192.168.1.0/24) and denies it before rule 2 is ever evaluated. The permit rule is never reached. The PERMIT rule overrides all DENY rules in an ACL — the problem is a network routing issue, not the ACL rule order. The implicit deny at the end of every ACL blocks the administrator's traffic even though an explicit permit exists for their IP.

Question 3 of 6

A user's workstation is compromised by malware. The network uses a properly designed three-tier segmented architecture with firewall ACLs between each tier. Which statement BEST describes the attacker's ability to access the organization's database?

The attacker has immediate database access because all systems are on the same internal network. The attacker cannot reach the database directly from the user workstation — the ACL between the user tier and the database tier blocks all traffic not originating from the application tier. Reaching the database requires an additional compromise of an application server. The attacker can reach the database if they know the correct port number, because port-based ACLs only block traffic on unknown ports. The attacker can reach the database directly through the application tier without compromising it, because the application tier functions as a transparent pass-through.

Question 4 of 6

An organization deploys antivirus software on all endpoints. A user opens a phishing email attachment containing a brand-new ransomware variant with no existing signatures. The ransomware executes and begins encrypting files. Which application control model would have prevented execution, and why?

A deny list would have prevented it — antivirus deny lists automatically block any application attempting to access the file system. An allow list would have prevented it — the ransomware executable was not on the approved application list, so execution would have been blocked by default regardless of whether it had a known signature. Network zone control would have prevented it — ransomware cannot execute when the device is connected to a corporate network zone. Certificate-based control would have prevented it — the ransomware would not have a valid digital certificate from a trusted publisher and would be blocked before execution.

Question 5 of 6

An organization uses AppLocker hash-based application control to permit their custom billing application. After the vendor releases a security update, all users find the billing application blocked on every workstation. What is the cause, and what is the correct long-term process to prevent recurrence?

The update changed the application's file path, which broke the hash rule. The correct process is to add all possible installation paths to the approved list. The update produced a new binary with a different SHA-256 hash. The AppLocker policy still contains the old hash, so the new binary fails the match check and is blocked. The correct process is to update the AppLocker policy with the new hash before deploying the software update — both must be coordinated in the same maintenance window. AppLocker automatically blocks all applications after an update until an administrator re-approves them — this is by design and requires a manual override for each update. Hash-based control is incompatible with vendor-provided updates and the organization should switch to network zone control for all third-party applications.

Question 6 of 6

Which application control mechanism best prevents the common malware delivery pattern of dropping an executable in a user's Downloads or Temp folder and running it directly from there?

Hash control — the malware binary will have a hash not found in the approved list and will be blocked. Certificate control — the malware will not be signed by a trusted publisher and will be blocked before execution. Path control — by permitting execution only from approved administrator-controlled directories (C:\Program Files\, C:\Windows\) and blocking execution from all user-writable locations including Downloads, Temp, and AppData, the attack is stopped regardless of the binary's hash or signature. Network zone control — execution from a Downloads folder is blocked when the device is connected to a public network zone.

Matching — Segmentation and Access Control Concepts

Match each term on the left to its correct description on the right.

1. VLAN

2. Implicit Deny

3. Allow List

4. Application Hash Control

1. 2. 3. 4.

A. An application control mechanism that uses the cryptographic fingerprint of an executable binary to determine whether it is permitted to run — cannot be bypassed by renaming the file, but requires policy updates on every software version change

B. A logical network segmentation technology that creates isolated broadcast domains on shared physical switching infrastructure using IEEE 802.1Q frame tagging

C. The default action applied when no ACL rule matches an evaluated connection — typically blocks the traffic, enforcing a "deny unless explicitly permitted" security posture

D. An application control policy stance where nothing may execute unless it has been explicitly approved — blocks zero-day and unknown malware by default because they have no entry in the approved list

Segmentation and Access Control Quiz

Matching — Segmentation and Access Control Concepts