A network security architect is tasked with redesigning the enterprise network to reduce the attack surface. Which approach directly reduces the number of exploitable network paths an attacker can take?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you cut exploitable paths by segmenting the network and using firewall-enforced ACLs between segments to limit traffic flows. More bandwidth just boosts performance, and a SIEM only helps you see what happened.
Full Explanation
Network segmentation with firewall-enforced ACLs between segments is correct because it limits the permissible traffic paths between zones, forcing attackers to traverse controlled checkpoints rather than move freely. Adding more bandwidth to the core network for better performance is wrong because bandwidth is a performance concern with no direct security benefit. Deploying an additional SIEM to correlate more log sources is wrong because a SIEM improves detection but does not reduce network attack surface. Requiring VPN for all remote users while leaving internal segments flat is wrong because VPN protects remote access but does nothing to prevent lateral movement on the already-flat internal network.