Segmentation vs Isolation for Customer Data

Given a scenario, select mitigation techniques or controls to secure an enterprise environment.

An organization would like to store customer data on a separate part of the network that is not accessible to users on the main corporate network. Which of the following should the administrator use to accomplish this goal?

  1. Segmentation Correct Answer
  2. Isolation
  3. Patching
  4. Encryption
Answer Correct answer: A — Use network segmentation to place customer data in a separate subnet or VLAN that is inaccessible from the main corporate network.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Tests the distinction between segmentation (separate network part with controlled access) and isolation (fully standalone network); the trap is choosing isolation because the data must be inaccessible to corporate users.

This SY0-701 scenario asks how to keep customer data on the network while blocking access from the main corporate LAN. The correct control is network segmentation (A), which separates the data into its own subnet or VLAN with access restrictions, not full isolation or encryption.

Many learners pick isolation (B) because it sounds more secure, but isolation means a completely disconnected or air-gapped environment, while the question specifies the data remains on a separate part of the existing network.

Community Discussion (10 comments)

MAKOhunter33333333 👍 14 Selected: A
Mentions the org wants to store it on the network just separate from the main network, which is segmentation.
AutoroTink 👍 7
Further notes: Isolation is a security measure that can be used to protect sensitive data which typically involves creating a completely separate environment, such as a different physical server or a standalone network, which can be more restrictive than segmentation. The question has the data still on the network, just in a separate part. So, Option A is still the best answer.
famuza77 👍 1 Selected: B
it is Isolation
dbrowndiver 👍 3 Selected: A
Segmentation is the correct answer because it involves creating distinct network segments that control access and separate sensitive customer data from the main corporate network. Network segmentation is the most appropriate solution for ensuring that customer data is stored securely and not accessible to unauthorized users.
drosas84 👍 5 Selected: A
Network segmentation involves dividing a network into subnets to control access and traffic flow. Network isolation is more severe, creating a standalone network with no connectivity to other parts of the network. It's a stringent form of segregation.
hasquaati 👍 2 Selected: A
Answer is A. While Isolation is a legitimate answer, that design is more relevant to machinery and manufacturing equipment.
AutoroTink 👍 1 Selected: A
While isolation is a broader concept that can include segmentation, it typically refers to completely separating a system or environment from others, which might be more extreme than necessary for this purpose. Segmentation can help in isolating the customer data from the main corporate network, ensuring that it is not accessible to unauthorized users
Yoez 👍 1 Selected: B
The correct answer is: B. Isolation Isolation involves creating separate network segments or zones that restrict access between them. By isolating the network segment where customer data is stored from the main corporate network, the organization can prevent unauthorized users on the corporate network from accessing the sensitive customer data. This helps enhance security by limiting the potential attack surface and reducing the risk of unauthorized access or data breaches.
shady23 👍 1 Selected: A
A. Segmentation
3056f7e 👍 1
B cause A only involves dividing a network into smaller segments to improve security and performance but may still allow communication between segments.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Network segmentation (A) is the correct choice because it divides the network into separate segments—such as VLANs or subnets—and uses access controls (firewalls, ACLs) to prevent the main corporate network from reaching the customer data segment. The scenario explicitly says the data will be stored "on a separate part of the network," not removed from the network entirely, which aligns perfectly with segmentation. In CompTIA's SY0-701 terminology, segmentation is the standard mitigation for limiting lateral movement and protecting sensitive data while keeping it accessible to authorized systems. As commenter AutoroTink noted, "the data still on the network, just in a separate part." This control enforces least privilege at the network layer without requiring a fully isolated environment.

Why the Other Options Are Wrong

Isolation (B) would be appropriate if the goal were a completely standalone network with no connectivity to the corporate network—often described as air-gapped. The question does not call for that extreme; it says the data is stored on a separate part of the network, implying shared infrastructure with controlled access. Patching (C) addresses software vulnerabilities and does not create network separation, so it cannot prevent corporate users from reaching the data. Encryption (D) protects data confidentiality if it is intercepted or stolen, but it does not prevent users on the main network from accessing the storage segment; access control through segmentation is still required. Commenters like drosas84 noted that isolation is "more severe, creating a standalone network with no connectivity," which is not what the scenario describes.

Community Comment Notes

The majority of commenters (MAKOhunter33333333, AutoroTink, drosas84, dbrowndiver, shady23) selected A, emphasizing that the data remains on the network and that segmentation controls access between subnets. A few learners (Yoez, famuza77, 3056f7e) chose B, arguing that isolation restricts access, but their reasoning conflates isolation with segmentation; commenter hasquaati noted that isolation is more relevant to machinery or manufacturing equipment. The consensus built around A because "segmentation involves dividing a network into subnets to control access and traffic flow" and the question's wording specifically keeps the data on a separate network part.

Official Reference

Exam Strategy

Focus on the wording: "separate part of the network" points to segmentation, while a "completely separate or standalone network" would indicate isolation. CompTIA tests this distinction by describing whether the data remains on the existing network infrastructure with controlled access.

Frequently Asked Questions

Why is isolation (B) not the best answer for storing customer data separately?

Isolation means a fully standalone or air-gapped network with no connectivity, but the scenario keeps the data on a separate part of the same network, so segmentation is correct.

Can encryption (D) alone prevent corporate users from reaching the customer data?

No. Encryption protects data confidentiality but does not block network access; users on the main corporate network could still reach the storage unless network segmentation enforces access control.

More SY0-701 FAQ →

Related Analysis

Which of the following should a security team do first befor

S-Grade

An organization’s internet-facing website was compromised wh

S-Grade

A penetration tester begins an engagement by performing port

A-Grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide