Network Segmentation
On a submarine, one network reaches the weapons console, the sonar suite, and the crew's movie server. Segmentation draws the bulkheads — so a breach in one compartment can't flood the whole ship.
In Topic 3.1 you saw how a flat network lets one compromised device reach everything. Segmentation is the mitigation: divide the network into smaller, isolated subnets so traffic is contained and each zone can carry its own security policy.
The payoff is blast radius — the number of systems an attacker can touch from a single foothold. Segmentation shrinks it, turning a ship-wide compromise into a single-compartment problem.
Divide the Network
Subnetting, VLANs, and screened subnets split one network into isolated segments.
3.3.A · TechniquesIsolate Traffic
Each segment can apply its own controls — higher-security zones and lower-security zones.
3.3.B · ZonesContain the Breach
If one subnet is compromised, isolation keeps the attack from reaching the rest.
Blast radiusYou're the network architect aboard a fictional submarine. Weapons systems, naval operations, crew recreation, admin/management, and a restricted data zone all need to coexist on one hull — but never on one flat network. Your task: design the segments and recommend the security features for each LAN.
AP Learning Objectives
- 3.3.AIdentify techniques for segmenting a network.
- 3.3.BExplain why network segmentation can increase network security.
Segmentation doesn't stop an attacker from getting in — it limits how far they can go once they do. By isolating traffic and applying different policies to different zones, a breach in low-trust crew recreation never becomes a breach of the weapons console.
What you'll be able to do: name segmentation techniques, assign systems to zones, rank zones by trust, set traffic permissions between segments, contrast flat and segmented networks, simulate a breach's blast radius, and recommend the right technique for each LAN.
Dividing the Network — and Why It Helps
A few techniques create the boundaries; a single principle explains the benefit.
Segmentation means dividing a network into smaller, isolated subnets. Subnetting splits the network by IP addressing so a compromise exposes fewer devices. VLANs, created on switches, logically separate devices that share the same physical switch. A screened subnet (DMZ), built from firewall zones and rules, sits between an external network and the private internal network and holds public-facing resources in a lower-security zone.
Why does this raise security? Isolated traffic means an attack on one subnet is contained and can't easily reach the others. And because each segment is separate, you can apply different policies and controls to each — strict rules around weapons systems, looser ones for crew recreation. (On the switches themselves, port security limits the MAC addresses per port, blocking MAC flooding.)
Diagram · Flat network vs segmented network
Diagram · Blast radius reduction
Flat vs Segmented Network Comparison
Lab · CompareFlip between the two designs and watch how four key properties change.
Concept Check
30 secOn a flat submarine network, an adversary compromises a crew recreation PC. What's the danger?
Techniques & Trust Zones
The ways to divide a network, and how the submarine's zones rank by trust.
| Technique | What it does |
|---|---|
| Subnetting | Divides the network by IP addressing; a breach exposes fewer devices. |
| VLAN | Created on switches to logically separate devices on the same physical switch. |
| Screened subnet (DMZ) | A firewall-zoned segment between external and internal networks for public-facing resources. |
| Firewall zones & rules | Define higher- and lower-security zones and control traffic between them. |
| Port security | Limits MAC addresses per switch port to prevent MAC flooding. |
Diagram · Trust zone map
Trust Zone Drag-and-Drop
Lab · ClassifySelect each submarine LAN, then drop it into the trust level it deserves.
Highest trust
Mission-critical / classified
High trust
Operational / management
Low trust
Non-sensitive / convenience
What the Exam Rewards
This topic is Mitigate Risk — skill 2.A: identify a control and explain how it mitigates the risk.
Skill 2.A. Don't just say "segment the network." Explain the mechanism: "VLANs isolate the weapons LAN so a breach of crew recreation can't reach it."
Scenario 3C. The exam asks you to recommend security features for each LAN and show them on a diagram — so know which technique fits which need.
Common MCQ traps
"Segmentation stops attackers from getting in."
It limits how far they spread after entry — it contains the breach, it doesn't prevent it.
"A DMZ is the most secure zone."
A screened subnet is a lower-security zone for public-facing resources, not the most protected one.
"VLANs need separate physical switches."
VLANs logically separate devices that share the same physical switch.
Analyst note — submarine: the weapons systems LAN and restricted data zone sit in the highest-trust segment with their own firewall rules; crew recreation lives in a low-trust segment with internet access but no path inward. When you explain why traffic between them is denied, you're demonstrating skill 2.A.
Traffic Permission Matrix
Lab · Allow / DenySet each proposed cross-zone flow to Allow or Deny using least-privilege, then check your rules.
Build the Submarine's Segmented Network
The command board. Place each system into its correct LAN to design a segmented network that contains any single breach.
Submarine LAN Segmentation Builder
Lab · Mitigate (2.A)Select a system, then drop it into the LAN where it belongs. Group like with like and keep mission-critical systems away from low-trust ones.
Weapons systems LAN
Highest security
Naval operations LAN
High security
Crew recreation LAN
Low security
Admin / management
Network management
Restricted data zone
Classified data
Misconceptions That Cost Points
Each is a planted wrong answer. Learn to see the trap.
"Segmentation is mostly about network speed."
Its security value is isolation — containing a breach and enabling per-zone policies.
"Crew Wi-Fi and weapons systems can share a subnet."
Low-trust and highest-trust systems must be separated so a recreation breach can't reach weapons.
"Every zone should have identical security rules."
Segmentation exists so each zone can carry its own policy — strict for data, looser for recreation.
"Port security and segmentation are unrelated."
Port security limits MACs per switch port to stop MAC flooding — reinforcing segment boundaries.
"A DMZ holds your most sensitive data."
The screened subnet is a lower-security zone for public-facing resources, kept off the internal network.
"Once segmented, all cross-zone traffic is fine."
Apply least privilege between zones — allow only the flows that are actually needed.
Recommend & Simulate
A reference on why segmentation helps, plus two labs: watch a breach's blast radius, then recommend a technique per need.
| Benefit | How it works |
|---|---|
| Isolated traffic | Subnets keep each segment's traffic separate from the others. |
| Contained breach | A compromise on one subnet can't easily reach devices on another. |
| Smaller blast radius | Fewer devices are exposed from any single foothold. |
| Per-zone policy | Higher- and lower-security zones can apply different controls. |
Blast Radius Simulator
Lab · SimulateChoose flat or segmented, pick the zone the adversary lands in, then launch the breach and watch how far it spreads.
Segmentation Recommendation Board
Lab · 5 needsFor each network need, recommend the segmentation technique that fits best.
Prove the Segmentation Plan
Five AP-style questions with instant feedback, then a snapshot to lock it in.
Mini AP-Style Quiz
Lab · 5 questionsChoose one answer per question, then submit for scored feedback with explanations.
Five Takeaways
Segmentation = isolation. Divide the network into smaller, isolated subnets.
Three core techniques. Subnetting (by IP), VLANs (on switches), and screened subnets/DMZ (firewall zones).
It contains breaches. Isolated traffic stops an attack on one subnet from reaching the others.
Per-zone policy. Higher- and lower-security zones can apply different controls.
Port security supports it. Limiting MACs per port blocks MAC flooding at the segment edge.
Final AP exam tip: to earn the mitigation point, name the technique and the effect — "place weapons systems on a separate VLAN so a breach of crew recreation can't reach it." If a prompt asks for a diagram, show each LAN as its own segment with the boundaries between them.
One mistake to avoid: don't say segmentation "prevents attacks." It contains them — the attacker may still get into one segment, but isolation stops the spread.
Practice — attempt these now.
AP-style assessments aligned to this lesson. Time them.