Where does a screened subnet (DMZ) sit?

Inside the most secure part of the internal network

Which server most belongs in a screened subnet?

The school's public website server

The server holding student grades

What do virtual local area networks (VLANs) do?

Logically separate devices physically connected to the same central switches

Malware infects one laptop in a segmented network. Why are fewer devices exposed than in a flat network?

The subnet boundary isolates traffic, containing the breach

The laptop is disconnected by the VLAN

Segmented networks have no internet access

Segmentation removes the malware automatically

A hospital wants stricter controls for medical records than for its guest Wi-Fi. How does segmentation help?

Each segment can have its own security policies and controls

It makes every segment equally secure

It removes the need for a firewall

Which switch feature prevents MAC flooding?

Port security limiting the number of addresses per port

AP® Cybersecurity 3.3 Protecting Networks: Segmentation Notes and Practice

1. Ways to segment a network (3.3.A)

Technique	How it works
Screened subnet (also called a demilitarized zone, or DMZ) 3.3.A.1	Firewall zones and rules create a segment between the public internet and the internal private network. It is usually a lower security zone and holds public-facing resources, such as the website, keeping them apart from the internal network.
Subnetting 3.3.A.2	Creates separate subnets based on IP addressing. If an adversary compromises one device, the subnet boundary contains the breach and fewer devices are exposed.
Virtual local area networks (VLANs) 3.3.A.3	Switches logically separate devices that are physically connected to the same central switches.

The internet connects to an outer firewall. Behind it, the screened subnet holds a web server and a mail server. A second, stricter firewall separates the screened subnet from the internal network with staff computers and a file server. — A screened subnet: outsiders can reach the public servers, but a second, stricter firewall guards the internal network.

Case file: Northgate High

The school’s network is split into four segments: a screened subnet for the public website, a staff subnet with grade records, a student VLAN for classroom laptops, and a VLAN for security cameras. When a student laptop catches malware, its traffic stays on the student VLAN, and firewall rules keep it away from the staff subnet and the cameras.

2. Why segmentation increases security (3.3.B)

Network segmentation means dividing a network into smaller, isolated segments, or subnets 3.3.B.1.
Isolating traffic means an attack on one subnet can be kept from affecting devices on other subnets 3.3.B.2.
Each segment can get its own security policies and controls, creating higher and lower security zones 3.3.B.3.
On switches, port security limits how many MAC addresses any single port can have, which prevents MAC flooding 3.3.B.4. Try that in the MAC flooding simulator in 3.1.

Prevent: put the most valuable data in the smallest, most tightly controlled segment.

Lock it in: memory hooks

One picture per idea. If you remember the hook, you can rebuild the details.

SegmentationShip bulkheads: one flooded compartment does not sink the ship.
Screened subnetThe lobby of the network: visitors get in, but there is another locked door before the offices.
VLANSame cables, different rooms: a VLAN draws walls in software.

Common misconceptions

"The screened subnet is the most secure part of the network."
Not quite. A screened subnet is usually a lower security zone than the internal network. It holds public-facing servers so that outsiders never need to reach the internal network.
"A VLAN needs its own separate switches."
Not quite. VLANs logically separate devices that are physically connected to the same central switches.
"Segmentation stops every attack."
Not quite. It does not stop the first compromise. It limits how far the breach spreads, so fewer devices are exposed.

Exam traps

The screened subnet (DMZ) is a lower security zone than the internal network, not a higher one.
Port security prevents MAC flooding; a VLAN separates devices logically on the same switches.

By the numbers

Say each list out loud, then tap to check.

3 techniques Say them, then tap

screened subnet (DMZ)
subnetting by IP address
VLANs on switches

2 benefits Say them, then tap

contain attacks to one segment

different security levels per segment

In 30 seconds

Segmentation divides a network into smaller isolated segments (subnets).
Screened subnet (DMZ): between the internet and the internal network, lower security, holds public-facing resources.
Subnetting by IP address contains a breach to fewer devices. VLANs separate devices on the same switches logically.
Benefits: attacks on one subnet do not reach others, and each segment can have its own security policies and controls.
Port security limits addresses per switch port, preventing MAC flooding.

Cover this list, say the points out loud, then take the checkpoint without scrolling back up.

Key terms: flip the cards

Read the term, say the definition out loud, then flip to check. Struggling a little to remember is what makes it stick.

Network segmentationtap to flip

Dividing a network into smaller, isolated segments or subnets so attacks are contained and each segment can have its own security level.
Example and CED codes
Screened subnettap to flip

A network segment, created with firewall zones and rules, between the internet and the internal network that holds public-facing resources; a lower security zone.
Example and CED codes
Subnettingtap to flip

Creating separate subnets based on internet protocol (IP) addressing so a compromised device exposes fewer others.
Example and CED codes
Virtual local area network (VLAN)tap to flip

A logical network created on switches that separates devices physically connected to the same central switches.
Example and CED codes
Port securitytap to flip

A switch feature that limits how many media access control (MAC) addresses can be assigned to a single switch port.
Example and CED codes
MAC floodingtap to flip

Sending a switch many frames with different fake media access control (MAC) addresses so its table fills and it broadcasts frames out of every port.
Example and CED codes
Firewalltap to flip

Software that allows or denies network traffic in or out of a network using a set of rules called an access control list (ACL); it runs on its own device or inside another one, such as a router.
Example and CED codes

Questions students ask

What is a screened subnet or DMZ?

A network segment between the public internet and the internal private network, created with firewall zones and rules. It typically holds an organization's public-facing resources, such as a web server, and is a lower security zone than the internal network.

How does network segmentation improve security?

It isolates traffic so an attack on one segment cannot easily reach devices on others, and it lets the organization apply stronger controls to more sensitive segments.

What is the difference between subnetting and a VLAN?

Subnetting separates devices by IP addressing. A VLAN uses switches to logically separate devices that are physically connected to the same central switches.