A network administrator is implementing security zones for each department. Which of the following should the administrator use to accomplish this…

Access Control Lists (ACLs) are rules applied to router or firewall interfaces to filter traffic based on criteria such as source/destination IP addresses and port numbers. To implement security zones for different departments, an administrator would first segment the network, typically by assigning each department to its own VLAN and IP subnet. Then, ACLs are applied to the Layer 3 device (router or multilayer switch) that routes between these subnets. These ACLs explicitly define which traffic is permitted or denied between the departmental zones, thereby enforcing the security policy and creating the desired segmentation.

B. Port security: This is a Layer 2 switch feature that restricts which MAC addresses can connect to a specific port; it does not control traffic flow between network segments (zones).

C. Content filtering: This technology is used to block access to specific types of web content or applications, not to create and enforce boundaries between internal network departments.

D. NAC: Network Access Control (NAC) authenticates devices and checks their security posture before allowing them on the network; it does not primarily function to filter traffic between established zones.

1. National Institute of Standards and Technology (NIST). (2009). Special Publication 800-41 Revision 1

Guidelines on Firewalls and Firewall Policy. Section 3.2

"Network Segmentation

" states

"Network segmentation involves partitioning a network into smaller

isolated networks called zones... Firewalls are placed at the boundaries of zones to control the flow of traffic between them." Firewalls fundamentally operate using Access Control Lists (ACLs) to enforce these controls.

2. Cisco. (2022). IP Addressing: ACL Configuration Guide

Cisco IOS XE Amsterdam 17.3.x. In the "Information About IP Access Lists" section

it is stated

"You can use access lists to control the movement of packets through a router... You can use access lists to provide a basic level of security for your network by controlling access to an area." This directly supports using ACLs to create controlled zones.

3. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM

17(7)

38-47. This foundational paper on computer security outlines the principle of "least privilege

" which is implemented in networking through mechanisms like ACLs to create security zones where entities (like departments) only have access to the resources they absolutely require. ACLs are the technical implementation of this policy between network segments. (DOI: https://doi.org/10.1145/360813.360818

Section I.A.3).