What is network segmentation and how does it relate to zero trust?

• A. Dividing networks into subnets to limit lateral movement; zero-trust extends segmentation by requiring continuous verification per access attempt.
• B. Dividing networks to improve throughput; zero trust eliminates authentication.
• C. Segmentation applies only to wireless networks.
• D. Zero trust removes the need for any segmentation.

Answer: (A)

Network segmentation is dividing a network into smaller, isolated subnets or zones so that a breach in one area cannot automatically spread to others. This containment helps you enforce tighter controls and monitor traffic at the boundaries of each segment, effectively limiting how far an attacker can move laterally.

Zero trust builds on that by treating every access attempt as untrusted and requiring continuous verification. With segmentation in place, zero trust uses these boundaries as enforcement points and applies strict, context-aware checks for each access request—identity, device health, and the specific resource being accessed—before allowing any action. In this way, segmentation provides the structural zones, while zero trust adds ongoing authentication and authorization to every interaction, greatly reducing risk even inside the network.

Through this lens, the other ideas don’t fit: segmentation isn’t mainly about improving throughput, and zero trust doesn’t remove authentication; it hinges on it, applying it continuously. Segmentation isn’t exclusive to wireless networks, and zero trust doesn’t dispense with segmentation.