Attackers compromised a lobby visitor kiosk and then reached the finance servers directly, because every device in the building sits on one flat network. Which mitigation most directly prevents an attacker from repeating that lateral path?
Select an answer to reveal the explanation.
Short Explanation
A flat network is like an office with no interior doors: get in the lobby and you can walk straight into accounting. Segmentation puts walls and locked doors between zones, so a compromised kiosk can't even see the finance servers. Antivirus and passwords are nice, but you'd still have no walls.
Full Explanation
Network segmentation divides a network into zones, typically using VLANs, subnets and firewall or access control rules between them, so that traffic between zones is permitted only where there is a business need. Placing kiosks in an isolated zone with no route to the finance servers removes the lateral path entirely: even a fully compromised kiosk cannot connect to systems it was never meant to reach. Antivirus with weekly scans may detect some malware on the kiosk, but it does not stop an attacker using legitimate tools or undetected code, and once the kiosk is compromised the flat network still exposes everything. Complex passwords on kiosk accounts make initial access harder, yet the attackers already got in, and the question is about the path they used afterward. Full-disk encryption protects data at rest if a server's drives are stolen; a running finance server decrypts its data transparently for anyone who reaches it over the network, so it does not block lateral movement. Exam caveat: segmentation limits the blast radius of a compromise and is most effective when inter-zone rules default to deny. Operational check: from a device in the kiosk zone, attempt connections to finance server addresses and ports, confirm every attempt is blocked and logged, and review the inter-zone rule set for any broad allow rules.