A network security engineer is designing a network where a compromised host in the employee VLAN should not be able to directly communicate with servers in the production VLAN. Which Layer 3 control enforces this?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need inter-VLAN routing ACLs on the Layer 3 switch or router to deny traffic from the employee subnet to the production subnet. That enforces segmentation where VLAN traffic is routed. The other controls protect switching or address assignment, not inter-VLAN traffic.
Full Explanation
Inter-VLAN routing ACLs on the Layer 3 switch or router are correct because the device that routes between VLANs can explicitly deny traffic from the employee subnet to the production subnet, enforcing network segmentation at Layer 3. STP root guard preventing unauthorized switches from becoming the root bridge is wrong because it protects spanning-tree topology from manipulation but does not restrict inter-VLAN traffic flow. DHCP snooping preventing rogue DHCP servers from assigning addresses is wrong because it controls DHCP trust and address assignment but does not restrict traffic routing between VLANs. Dynamic ARP inspection preventing ARP spoofing within VLANs is wrong because it validates ARP messages inside a VLAN but does not restrict inter-VLAN routing.