400-007: Cisco Certified Design ExpertDemo

By Cisco · Question Mode

QuestionQ27

Security Design

A customer has a functional requirement stating that HR systems in a data center must be segmented from other systems located in the same data center and VLAN. The systems run legacy applications using hard-coded IP addresses, with all HR systems assigned .129 through .254 in the 10.20.20.0/24 prefix. Which segmentation method is optimal for the customer?

  • A data center perimeter firewalling
  • B routed firewalls
  • C VACLs on data center switches
  • D ACLs on data center switches
Explanation

VLAN access control lists (VACLs) enforce filtering for traffic bridged within the same VLAN, so they can isolate the HR address range from other hosts without changing the VLAN or the legacy applications’ hard-coded IP addresses. Routed firewalls and routed ACLs do not control same-VLAN traffic that is switched locally.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!