Which of the following can be configured on a VLAN gateway to add layer 3 security to the VLAN?

Optimize your success on the FSNA Readiness Exam. Engage with flashcards and multiple choice questions, each designed with hints and explanations. Prepare thoroughly for your test and excel!

Multiple Choice

Which of the following can be configured on a VLAN gateway to add layer 3 security to the VLAN?

The thing being tested is using an Access Control List on the VLAN gateway to control traffic at the IP layer. An ACL lets you specify which packets are allowed or denied based on source and destination IP addresses, and optionally on protocol and port numbers. When you apply an ACL to the inter-VLAN routing path on a router or L3 switch, you define what traffic can move between VLANs or to external networks. This directly enforces layer 3 security by filtering at the gateway that connects the VLANs, providing a boundary that blocks unwanted communications while permitting required ones. For example, you can allow only HTTP/HTTPS from one VLAN to a specific server in another VLAN while denying other services, or restrict management traffic to trusted devices. The other options don’t fit as cleanly for adding L3 security on the VLAN gateway. Network Access Control focuses on authenticating devices before they join the network, not on filtering routed traffic between VLANs at the gateway. A Demilitarized Zone is a separate network segment for exposed services, not a gateway-level filter mechanism between VLANs. A Honeynet is a deceptive system used to attract attackers and study their behavior, not a standard mechanism for enforcing inter-VLAN security on a gateway.

The thing being tested is using an Access Control List on the VLAN gateway to control traffic at the IP layer. An ACL lets you specify which packets are allowed or denied based on source and destination IP addresses, and optionally on protocol and port numbers. When you apply an ACL to the inter-VLAN routing path on a router or L3 switch, you define what traffic can move between VLANs or to external networks. This directly enforces layer 3 security by filtering at the gateway that connects the VLANs, providing a boundary that blocks unwanted communications while permitting required ones. For example, you can allow only HTTP/HTTPS from one VLAN to a specific server in another VLAN while denying other services, or restrict management traffic to trusted devices.

The other options don’t fit as cleanly for adding L3 security on the VLAN gateway. Network Access Control focuses on authenticating devices before they join the network, not on filtering routed traffic between VLANs at the gateway. A Demilitarized Zone is a separate network segment for exposed services, not a gateway-level filter mechanism between VLANs. A Honeynet is a deceptive system used to attract attackers and study their behavior, not a standard mechanism for enforcing inter-VLAN security on a gateway.

More practice questions