Network segmentation

Network segmentation divides a network into zones with controlled crossing points, so that compromising one host does not grant free lateral movement to everything else. Each segment groups systems of similar sensitivity or function (user workstations, servers, payment systems), and traffic between segments passes through an enforcement point where policy applies. It is defense in depth applied to network architecture: an attacker who lands inside the perimeter still faces internal boundaries.

The exam distinguishes three depths. Physical segmentation uses separate hardware or air gaps: strongest, most expensive, right for the most sensitive systems. Logical segmentation uses VLANs, subnets, and internal firewalls to divide shared infrastructure: the everyday default. Micro-segmentation pushes policy down to the individual workload, so even two servers in the same segment need explicit permission to talk; it governs east-west traffic and is the network foundation of zero trust, where no location implies trust.

Exam relevance: if a scenario asks how to contain lateral movement or limit the blast radius of a breach, the answer is segmentation; if it asks for workload-level control of east-west traffic, the answer is micro-segmentation. Contrast a VLAN, which is just one layer 2 mechanism for achieving logical segmentation, not the whole discipline itself.