AP Cybersecurity Drill 11: Segmenting Three LANs

Question 1. Which statement best identifies the clearest confidentiality risk in the current unrestricted network and explains why?

• A) The shop floor reaching the office network, because production downtime on that particular line is costly
• B) The office reaching the guest network, because two different groups of staff users overlap there
• C) The shop floor reaching the guest network, because both of those groups connect over wireless only
• D) Untrusted guest devices reaching the office payroll file server, exposing confidential employee data ✓

Explanation: Choice D is correct. The network is flat, so untrusted guest devices can reach the office file server that holds payroll records; an outsider's compromised laptop reaching confidential employee data is the sharpest confidentiality exposure in the table. Choice A is incorrect. Shop-floor-to-office traffic is a concern, but both are internal company groups and the issue there is availability, not confidentiality of employee data. Choice B is incorrect. The table does not show two staff groups overlapping; the guest group is for outsiders. Choice C is incorrect. The stimulus does not say the shop floor is wireless, and connection type is not what creates the payroll exposure.

Question 2. What is the name for the weakness created by having all three groups on one network where every device can reach every other device?

• A) A flat network that has no segmentation in place between the groups ✓
• B) A demilitarized zone set aside for the hosting of public-facing servers
• C) A virtual private network used for encrypted remote staff access
• D) An air-gapped network kept entirely disconnected from all others

Explanation: Choice A is correct. A single network with no internal boundaries, where every device can reach every other device, is a flat network that lacks segmentation; that is exactly the condition described. Choice B is incorrect. A demilitarized zone is a separated segment for public-facing services, which is the opposite of the unseparated setup here. Choice C is incorrect. A virtual private network provides an encrypted remote-access tunnel and does not describe an internal flat network. Choice D is incorrect. An air-gapped network has no connection to other networks at all, which is not the case when all devices can reach one another.

Question 3. Which change most directly enforces the administrator's goal of keeping a problem on one network from automatically reaching the others?

• A) Give every single device on the shared network a considerably longer and more complex account login password to use
• B) Rename each one of the three device groups with a clearer and more descriptive network label
• C) Put each group on its own segment, such as separate VLANs, allowing only permitted traffic between ✓
• D) Install antivirus software on each of the visitor laptops that connect to the guest wireless network

Explanation: Choice C is correct. Putting each group on its own segment and permitting only specific traffic between segments is network segmentation, which stops trouble on one segment from spreading freely to the others. Choice A is incorrect. Longer passwords help with account security but do nothing to separate the three networks from one another. Choice B is incorrect. Renaming networks is only a label and does not restrict traffic between them. Choice D is incorrect. Antivirus on visitor laptops, which the company does not control, does not separate the networks or protect payroll data if one segment is compromised.

Question 4. After the networks are segmented, why should the guest segment be allowed to reach the internet but not the office or shop-floor segments?

• A) Because the business ought to be able to bill its visiting guests separately for the internet they use
• B) Because visitors need internet but not payroll data or controllers, so blocking that path limits damage ✓
• C) Because the guest devices are already protected by the office firewall, so internal access is redundant
• D) Because the guest devices are technically not capable of using any traffic encryption on that segment

Explanation: Choice B is correct. Limiting the guest segment to the internet gives visitors what they need while removing any path to the payroll server or machine controllers, so a compromised visitor device cannot reach the company's sensitive systems. Choice A is incorrect. Billing is not a security reason and is not part of the administrator's goal. Choice C is incorrect. A firewall protecting the office segment does not justify giving guests internal access; the point is to deny that access. Choice D is incorrect. The stimulus does not say guest devices cannot encrypt traffic, and that is not the reason to isolate them.

Question 5. Once segmentation is in place, which ongoing activity would best help the administrator detect an attempt to cross from one segment to another?

• A) Count how many devices are connected to each of the separate segments at the start of every week
• B) Ask the visitors on the guest network whether any of them tried to reach the office payroll server
• C) Check once each day that all three of the network segments still carry a clearly different network name from one another
• D) Review the filtering device's logs for denied or unexpected attempts to reach the sensitive segments ✓

Explanation: Choice D is correct. The device that filters traffic between segments logs allowed and denied crossings, so reviewing it for denied or unexpected attempts to reach sensitive segments turns segmentation into active detection of boundary-crossing attempts. Choice A is incorrect. A device count may flag a new device but does not reveal attempts to move between segments. Choice B is incorrect. Relying on visitors to self-report is not a reliable way to detect attempts to cross segments. Choice C is incorrect. Confirming segment names are different verifies a label, not whether anyone tried to cross between segments.