During a network architecture review, a team finds that two business units share the same VLAN and IP subnet. A compromise of a workstation in Unit A led to credential harvesting across Unit B via SMB relay. Which architectural remedy directly addresses this threat?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — c is correct because SMB relay attacks exploit Layer 2 broadcast domains; PVLANs or micro-segmentation prevent host-to-host communication within the same subnet, neutralizing the relay path without requiring separate subnets. B is wrong because 802.1X authenticates devices to the network but does not prevent lateral traffic once authenticated.
Full explanation below image
Full Explanation
C is correct because SMB relay attacks exploit Layer 2 broadcast domains; PVLANs or micro-segmentation prevent host-to-host communication within the same subnet, neutralizing the relay path without requiring separate subnets. B is wrong because 802.1X authenticates devices to the network but does not prevent lateral traffic once authenticated. A is wrong because AV may detect known malware but does not block SMB relay at the network layer. D is wrong because perimeter firewalls typically do not inspect intra-VLAN traffic.