Network segmentation is the correct answer because it divides the larger network into smaller, isolated segments or subnetworks. By restricting access to each segment and applying controls, it limits how far an attacker can move laterally within the network after compromising a host. Access Control Lists (ACLs) and firewall policies are used within network segmentation for this purpose. On the other hand, VLANs are a form of segmentation but on their own are not a complete security solution. NAT is primarily used for IP address translation and does not inherently prevent lateral movement; and NIPS, while useful for identifying and possibly stopping threats, may not limit movement once a breach has occurred.