What defines network segmentation?

• A. Isolating Critical Systems With Encryption Only.
• B. Centralizing All Servers In A Single Data Center.
• C. Reducing Firewall Rules To A Strict Allow-All Posture.
• D. Dividing Networks Into Isolated Segments To Limit Lateral Movement And Contain Breaches, Enabling Targeted Controls.

Answer: (D)

The idea being tested is that network segmentation is about creating separate, isolated parts of a network with strict controls on how traffic can move between them. By dividing the network into segments and enforcing boundaries between them, you limit how far an attacker can travel if one segment is breached and you can apply more precise, targeted security controls to each segment.

This is why the best choice describes dividing networks into isolated segments to limit lateral movement and contain breaches, while enabling targeted controls. It captures the core purpose of segmentation: to reduce the blast radius and enforce specific protections at the boundaries between segments, so you can block or tightly monitor traffic that shouldn’t be moving across segments.

The other ideas don’t define segmentation: encryption alone protects data but doesn’t create network boundaries or prevent attackers from moving laterally within and across a network; centralizing servers in one data center describes a topology choice, not how the network is divided and protected; and an allow-all firewall posture removes the boundaries segmentation relies on, defeating the purpose of isolating segments.