ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Creating separate VLANs for the Finance servers and IoT devices places each group in its own logical network segment, which breaks up the shared layer-2 broadcast domain. By ensuring that any inter-VLAN communication is routed through a layer 3 firewall, the engineer can apply granular security policies while still permitting necessary traffic. Merely assigning different IP subnets without VLAN separation leaves both groups in the same broadcast domain, so broadcasts still reach all ports. Switch port mirroring is a monitoring feature and does not provide segmentation or traffic control. Static MAC filtering can limit device access but does not create separate broadcast domains and is difficult to manage at scale. Therefore, using distinct VLANs with inter-VLAN firewalling is the most effective and scalable choice.