A network security engineer is designing a network where a compromised host in the employee VLAN should not be able to directly communicate with servers in the production VLAN. Which Layer 3 control enforces this?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because inter-VLAN routing ACLs on the Layer 3 device that routes between VLANs can explicitly deny traffic from one VLAN to another, enforcing network segmentation at Layer 3. A is wrong because STP root guard prevents topology manipulation but does not restrict inter-VLAN traffic flow.
Full explanation below image
Full Explanation
B is correct because inter-VLAN routing ACLs on the Layer 3 device that routes between VLANs can explicitly deny traffic from one VLAN to another, enforcing network segmentation at Layer 3. A is wrong because STP root guard prevents topology manipulation but does not restrict inter-VLAN traffic flow. C is wrong because DHCP snooping prevents rogue DHCP servers but does not restrict traffic routing between VLANs. D is wrong because Dynamic ARP inspection prevents ARP spoofing within a VLAN but does not restrict inter-VLAN routing.