AP Networking 3.4: Building the Boundaries

Segmentation security means designing network zones around named threats: who could get in, what a rogue device could do, how far an attacker could spread. This guide covers the threat families, the control that limits each one, and the subnet math that turns a zone plan into real address ranges.

In Unit 2 you drew one boundary on a home network. Game day is a different animal. The school is hosting a regional gaming tournament: 24 wired player consoles, judges scoring on laptops, a streaming rig pushing live video, staff printers, and a hundred-plus spectator phones wanting Wi-Fi. One flat network would let any of those phones reach the scoring files. Topic 3.4 is where you design multiple segments from scratch, give each boundary a job, and size each zone's subnet so the plan fits.

• What is segmentation security?
• The three threat families in a segmented LAN
• Matching each threat to its control
• Subnetting step by step: the math
• Building the game day segment plan
• Practice: Zone Designer
• Verifying an AI-drafted subnet plan
• Key terms
• Frequently asked questions

What is segmentation security?

Segmentation security is the practice of splitting a network into zones so that a named threat in one zone cannot reach the assets in another, with controls chosen so each zone grants only the access its users actually need. That idea has a name: the principle of least privilege. Every user and every device gets the minimum access necessary for its task, and nothing else.

In Unit 2 the question was whether to have a boundary. Here every zone exists because a specific threat would land without it, and a good plan answers "what does this boundary protect against?" in one sentence, for every boundary on the map.

The three threat families in a segmented LAN

A network serving many user types and devices faces three recurring impacts: unauthorized access, unverified device connections, and data exposure. Each arrives through a different door.

Lateral movement is the threat students underestimate. Zones on a diagram do nothing by themselves: if the rules between subnets are permissive or wrong, a compromised streaming PC still reaches the scoring laptops. The boundary is only as strong as its policy.

Matching each threat to its control

Every threat family has a control family, and exam questions love to swap them. WPA3 does nothing against a rogue laptop on a wired port. Learn the pairs.

Subnetting step by step: the math

Subnetting is how zones become real. It divides one network into smaller sections called subnets, which helps with congestion, security, and management. The subnet mask decides which bits of an address name the network and which name the host; to subnet, you re-assign host bits as network bits. Fewer host addresses per subnet, more subnets.

The classic example: 192.168.1.0 with mask 255.255.255.0 is one network of 256 addresses, 254 usable. Change the mask to 255.255.255.128 and one host bit becomes a network bit, creating two subnets: 192.168.1.0 through 127, and 192.168.1.128 through 255.

Two addresses you can never hand out

In every subnet, the first address is the network address, identifying the subnet, and the last is the broadcast address, reaching every device at once. Neither can go to a host, so a subnet with n host bits holds 2^n - 2 hosts: 8 host bits give 256 addresses but 254 hosts; 5 host bits give 32 addresses but 30 hosts.

Right-sizing a zone in three moves

1. Count the hosts. The competition zone needs 24 consoles, 2 referee stations, and 1 scoreboard controller: 27 hosts.
2. Add two, round up to a power of two. 27 + 2 = 29. The next power of two is 32, which takes 5 host bits.
3. Write the range and verify. 192.168.10.0 with mask 255.255.255.224: network address .0, broadcast .31, usable hosts .1 through .30. After configuring, ping between two devices in the subnet to confirm it works.

The appropriate size is the smallest block that fits: 16 addresses would strand 13 consoles, and 64 wastes space the other zones need.

Building the game day segment plan

Run the same three moves for every zone, keep the ranges from overlapping, and the plan falls out of the arithmetic.

Each subnet becomes its own VLAN or segment, with deny-by-default policies between subnets and exactly one allowance: the scoreboard feed crossing from competition into streaming. The spectator SSID gets WPA2 or WPA3 with its own strong passphrase, never the staff one. And when a spectator phone shows up compromised, the plan already contains it: the phone can reach other phones and the internet, nothing else.

Practice: Zone Designer

Warm up with three sample questions, then design the zones yourself: assign every device to a segment, then name what the boundary protects against.

Three free sample questions

1. On a flat venue network, a compromised spectator phone opens the judges' shared scoring folder. Which weakness explains it?

Show answer

User groups and resources were not separated by access controls. No encryption failed and no rogue device plugged in; the phone was invited, and nothing stood between it and the staff resources (EK 3.4.A.2).

2. An unregistered laptop is found on an open competition-switch port holding a DHCP lease. Which control family answers this?

Show answer

MAC address filtering, unused ports set to down, and DHCP reservations for known devices. WPA3 and SSIDs are wireless controls; this threat arrived on a cable (EK 3.4.B.4).

3. A zone needs addresses for 12 staff devices. What is the appropriate subnet size?

Show answer

12 hosts plus the network and broadcast addresses is 14; the next power of two is 16, so 4 host bits and 14 usable addresses (EK 3.4.C.4).

Now the full case set, shuffled every run so you reason from the constraints.

Verifying an AI-drafted subnet plan

An AI assistant will happily draft your whole segment plan from a device census, and the draft is a useful starting point. It is also exactly the kind of confident artifact that hides one fatal flaw. Run three checks by hand before configuring anything.

Overlap: write out every range and compare. A staff block at 192.168.10.16-31 inside a competition block at 192.168.10.0-31 means two zones claiming the same addresses, and differing masks are exactly how that sneaks past a quick look. Fit: hosts plus two, rounded up to a power of two, for every zone. Privilege: does each group get only what its task needs, or did the draft quietly hand spectators a route to the printers? AI drafts; the network designer verifies.

Key terms

Least privilege

Users and devices get only the minimum access necessary for their tasks.

Lateral movement

An adversary spreading from a compromised segment into others through weak or misconfigured rules.

MAC address filtering

Admitting only approved hardware addresses, even on an open port.

DHCP reservation

Leasing addresses only to known devices.

Subnet mask

Splits an address into network bits and host bits; changing it turns one network into several subnets.

Network address

The first address in a subnet; identifies the subnet itself.

Broadcast address

The last address in a subnet; reaches every device in it.

Usable host range

Everything between those two: 2^n - 2 hosts for n host bits.

Frequently asked questions

What is segmentation security?

Designing network zones around named threats and controlling access between them, so each boundary stops something specific: unauthorized access, rogue devices, weak wireless, or lateral movement.

Why is a Wi-Fi password not enough?

A simple password or outdated encryption like WEP still exposes data to unauthorized users. The full control is a unique SSID, a strong password, and WPA2 or WPA3 encryption together.

What is lateral movement?

An attacker who compromises one segment moving on to other systems and segments. It happens where firewall or access rules between subnets are weak or misconfigured, which is why deny-by-default policies sit between zones.

What does MAC address filtering do?

It admits only devices whose hardware addresses are on the approved list. Paired with shutting unused switch ports and DHCP reservations, it keeps unknown or unverified devices off the network.

What does a subnet mask actually do?

It marks which bits of an address name the network and which name the host. Re-assigning host bits as network bits is how one network is divided into smaller subnets.

What is the difference between the network and broadcast addresses?

The network address is the first address in a subnet and identifies it; the broadcast address is the last and reaches every device in the subnet. Neither can be assigned to a host.

How many devices fit in a subnet?

2^n - 2, where n is the number of host bits: the two reserved addresses come off the top. A 32-address subnet holds 30 hosts; a 256-address subnet holds 254.

How do I choose a subnet size?

Count the hosts, add two for the reserved addresses, and round up to the next power of two. 27 hosts need 29 addresses, so a 32-address block with 5 host bits is the appropriate size.

Is subnetting the same as creating VLANs?

They work together: subnetting creates the address ranges, and assigning each subnet to a VLAN or segment isolates the traffic and creates the security zone. Every subnet needs a non-overlapping range.

How do I know my subnet configuration works?

Verify connectivity between two devices on the same subnet, for example with ping. If same-subnet neighbors cannot reach each other, the mask or range is wrong.

AP is a trademark of the College Board, which was not involved in the production of, and does not endorse, this resource.