| 🏠 Back to Exam Syllabus | 📺 RooCloud on YouTube | 🌐 RooCloud Practice Exams |
CISSP 11.11 - Segmentation
This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series learns how and why networks get divided into smaller pieces, part of Domain 4. Segmentation is one of your most powerful tools for containing damage, and designing internal boundaries and knowing which technique to use where is core architecture work you will do repeatedly.
What this episode covers
- Why segment at all — dividing a network boosts performance, reduces communication problems, and above all contains intruders.
- Physical segmentation — in-band shares infrastructure, out-of-band separates management traffic, and air-gapped fully isolates.
- Logical segmentation — software boundaries through virtual LANs, virtual private networks, routing separation, and virtual domains.
- The virtual private cloud — an isolated, self-governed network space carved out of a shared public cloud environment.
- Micro-segmentation — isolation down to a single device, with filtered, authenticated, encrypted, and logged communication.
- A foundation of zero trust — micro-segmentation stops lateral movement using overlays, distributed firewalls, and detection systems.
Watch the full episode above for the worked examples and detailed explanations of each concept.
Frequently Asked Questions
Why segment a network at all?
Because dividing a network into smaller units pays off three ways. It boosts performance, since machines that talk often can sit together and broadcast traffic stays contained. It reduces communication problems, cutting congestion and containing disruptions like broadcast storms. And it improves security, by isolating traffic and confining users to only the segments they are authorized to reach, so a problem in one wing does not spill into the rest.
What are the physical forms of segmentation?
They range from sharing a path to complete isolation. In-band segmentation runs both data and control traffic over the same infrastructure, so it often overlaps with logical division. Out-of-band segmentation splits management and control traffic onto a separate, dedicated network. The strictest form is air-gapped segmentation, a complete physical separation with no direct connection at all, and even wireless paths blocked.
What are the logical forms of segmentation?
They are divisions created in software rather than in cabling. Virtual local area networks split one physical network into separate isolated broadcast domains, grouping devices by function regardless of where they sit. Virtual private networks build encrypted channels across untrusted networks, virtual routing and forwarding lets one router hold multiple independent routing tables, and virtual domains carve one device into separate logical instances with their own policies.
How does a virtual private cloud fit in?
It is segmentation carried into the public cloud. A virtual private cloud is a virtualized network space a cloud provider gives you, letting you create isolated, logically separated networks inside a shared public environment. You host your applications and resources in a dedicated, controlled area while still governing the network configuration yourself. Along with private internal networks, screened subnets, and extranets, it is simply another kind of segment.
What is micro-segmentation, right down to a single device?
It is segmentation taken to its finest grain, isolating all the way down to a single high-value server or endpoint. Communication between these tiny zones is filtered, often requires authentication and encryption, and is closely monitored and logged. This makes it a cornerstone of zero trust, where nothing is trusted by default, and it is especially valuable for isolating sensitive workloads so an intruder cannot move sideways to reach them.
📚 Master the ISC2 CISSP Exam!
Ready to test your knowledge? Access chapter-specific Multiple Choice Questions (MCQs) and full-length practice exams for the ISC2 CISSP certification at RooCloud.com. Solve the chapter-wise questions to reinforce this lesson before moving to the next episode.
Reference: This article is based on concepts discussed in CISSP 11.11 - Segmentation.