A security architect argues that placing cardholder-data systems on their own isolated network segment is worthwhile beyond any performance gain. Which statement best describes a security benefit of network segmentation?
- AIt encrypts traffic between segments automatically, so a separate VPN or TLS session on the wire is no longer needed.
- BIt replaces access control lists, because hosts placed in different segments are then unable to exchange traffic of any kind.
- CIt limits an attacker's lateral movement, so a compromise in one segment cannot reach hosts in another without crossing a controlled boundary. Correct
- DIt stops malware from executing on hosts inside a segment, because the segment boundary inspects the contents of transferred files.
Why A is wrong: Segmentation does add security, but it separates traffic rather than encrypting it, so VPN or TLS is still required to protect confidentiality on the wire.
Why B is wrong: Segmentation controls inter-segment traffic rather than forbidding it, and ACLs or firewall rules are how that permitted traffic is defined, so they remain necessary.
Why C is correct: By forcing inter-segment traffic through a controlled boundary, segmentation contains a breach to its origin segment and blocks free lateral movement, a core security benefit.
Why D is wrong: Segmentation restricts network reachability; it does not scan file contents or halt code on a host, so it cannot prevent malware from running.