An IoT VLAN hosts municipal security cameras that should not freely reach workstation subnets. What should limit east-west movement?
Select an answer to reveal the explanation.
Short Explanation
Cameras need a path to their recorder—not a highway into every clerk PC. ACLs/firewalls keep IoT east-west traffic on a short leash. “Any-any for the vendor” is how lateral movement gets a VIP pass.
Full Explanation
An IoT VLAN hosting municipal security cameras should not freely reach workstation subnets. ACL or firewall policies that restrict IoT east-west and north-south flows to required services only—video servers, NTP, management collectors—limit lateral movement if a camera or IoT endpoint is compromised. Civic camera networks are frequent malware targets; VLAN membership without filtering is incomplete isolation.
Allowing any-any between IoT and corp VLANs to ease vendor support recreates a flat network. NATing the IoT VLAN onto the Internet and assuming that equals internal isolation ignores east-west paths inside the city LAN. Disabling logging on IoT firewall rules to improve throughput removes evidence needed for incident response.
Exam caveat: camera vendors often need specific ports—document allow-lists narrowly rather than opening whole subnets. Operational check: from a camera VLAN test host, confirm only approved destinations respond, attempt a workstation subnet connection and see deny/log, and review firewall hits after the test. In municipal WLAN programs, write the control into standards and verify it during change review so the next project inherits the same bar rather than rediscovering the failure mode under outage pressure.