You are configuring a network for a medium-sized enterprise. The goal is to separate different departments (e.g., HR, IT, Sales) using network segmentation while ensuring efficient utilization of IP addresses and controlling traffic flow between segments. Which of the following methods is the most appropriate to achieve this goal?

The most appropriate method is to combine Layer 2 and Layer 3 segmentation. Using Virtual LANs (VLANs) creates separate broadcast domains at Layer 2, logically isolating departments on the same physical network infrastructure. Assigning a unique IP subnet to each VLAN provides Layer 3 separation. This design allows for efficient IP address allocation tailored to each department's size. Traffic between these segments (inter-VLAN traffic) must pass through a Layer 3 device, such as a router or multilayer switch, which serves as a natural and effective point to implement access control lists (ACLs) or firewall policies to control inter-department communication.

A. A flat network does not provide segmentation. All devices are in the same broadcast domain, which is inefficient and insecure for a medium-sized enterprise, regardless of ACL implementation.
C. A single large subnet is a flat network that fails to achieve segmentation. Relying solely on firewalls in this topology is impractical and does not address broadcast traffic issues.
D. Implementing IP subnets without VLANs is not feasible on a modern switched network. Without VLANs, there is no Layer 2 mechanism to separate broadcast domains on shared physical switches.

1. Official Vendor Documentation:

Cisco. (n.d.). Configure InterVLAN Routing on Layer 3 Switches. Cisco Press. In the introduction, it states, "VLANs are used to segment switched networks for a variety of reasons... By default, hosts in one VLAN cannot communicate with hosts in another VLAN. To allow communication between VLANs, you need a device that can perform routing functions... Each VLAN is a unique broadcast domain. This means that a VLAN corresponds to a unique IP subnet." This directly supports the combination of VLANs and unique subnets for segmentation and controlled communication.

2. University Courseware:

Dordal, P. L. (2019). An Introduction to Computer Networks (2nd ed.). Loyola University Chicago, Department of Computer Science. Chapter 10.4, "VLANs," explains: "The standard mechanism for supporting VLANs is IEEE 802.1Q... A common arrangement is to have one IP subnet per VLAN; a host’s VLAN membership is then determined by its IP address." This highlights the standard practice of mapping one subnet to one VLAN.

3. Peer-reviewed Academic Publications / Standards:

National Institute of Standards and Technology (NIST). (2020). NIST Special Publication 1800-25: Data Integrity: Identifying and Protecting Assets Against Ransomware and Other Destructive Events. Section 3.4.1, "Network Segmentation," recommends: "Segment the network to prevent the spread of ransomware... Network segmentation can be accomplished through the use of virtual local area networks (VLANs), subnets, and firewalls." This source validates that VLANs and subnets are foundational technologies for achieving network segmentation.