Segmenting Same VLAN Systems with Legacy IPs
Short answer
C Use VACLs on data center switches to segment traffic within the same VLAN without changing hard-coded IP addresses.
Question
Key Takeaways
Tests understanding of Layer 2 vs Layer 3 segmentation constraints when legacy applications prevent IP reconfiguration.
Determines the correct segmentation method for HR systems in the same VLAN using legacy hard-coded IPs. Establishes that VACLs provide necessary Layer 2 isolation without requiring IP changes.
Common mistake: Choosing transparent firewalls (D) due to their ability to bridge networks, ignoring that they typically require distinct subnets or routed interfaces for effective policy enforcement and scalability in this specific context.
Expert Analysis
Why the Answer Is Correct
VACLs (VLAN Access Control Lists) are the suitable choice because they operate at Layer 2, allowing traffic filtering within a single broadcast domain (VLAN). Since the legacy applications use hard-coded IP addresses, moving them to a different subnet is not feasible. VACLs can segment traffic based on MAC addresses or IP headers within the same VLAN, providing the required isolation between HR and other systems.
Why the Other Options Are Wrong
Data center perimeter firewalling (A) protects the boundary of the data center but does not provide internal micro-segmentation. Routed firewalls (B) require Layer 3 routing, which implies changing the network topology and IP addressing, violating the constraint of hard-coded IPs. Transparent firewalls (D) act as a bridge; while they don't change IP addresses, they often complicate scaling and management compared to switch-based VACLs for intra-VLAN segmentation, especially when the goal is simple access control within the existing infrastructure.
Community Comment Notes
Community members like Charles2024 initially leaned towards transparent firewalls, citing scalability, but Devsin2000 correctly pointed out that transparent firewalls bridge VLANs/subnets, whereas VACLs are native to the switch layer for intra-VLAN control. kalulosu and noxkrugger confirmed VACLs as the right option for handling legacy systems within the same VLAN.
Exam Strategy
When faced with legacy systems that cannot have their IP addresses changed, prioritize solutions that operate at Layer 2 or do not require network re-architecting. Always evaluate if the proposed solution actually requires modifying the endpoint configuration before selecting it.
Frequently Asked Questions
Why not transparent firewalls for same VLAN?
Can VACLs filter by IP?
Community Votes
57% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 5
-
Charles2024 👍 3 Answered DNeeds to be scalable - so transparent fw. if it didnt have scalable then vacl
-
Devsin2000 👍 2 Answered C-Transparent firewall bridge two VLANs but same subnet - it's a technique . But in this case there is only one VLAN, and hence VACL is the right option.
-
kalulosu 👍 1 Answered CI think ans is C. VACLs (VLAN Access Control Lists) are an effective way to control and segment specific traffic, even within the same VLAN. It is particularly suitable for legacy systems that use hard- coded IP addresses.
-
noxkrugger 👍 1 Answered CYes C is right
-
noxkrugger 👍 1C is right.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.