Question

A security architect is redesigning access to a datacenter server VLAN that hosts sensitive production systems. Currently, administrators connect directly from their corporate workstations, which also handle email and web browsing. The architect wants to reduce the risk that a compromised workstation is used to reach production servers, while still allowing legitimate administrative sessions. Which segmentation-based control best addresses this requirement?

Accepted Answer

Deploy a hardened bastion/jump host in a dedicated management segment and require all administrative sessions to the server VLAN to traverse it, blocking direct workstation-to-server access

Answer

Place the production servers and administrator workstations in the same VLAN to simplify ACL management and reduce routing hops

Answer

Enable host-based firewalls on the production servers to log all inbound administrative connections from workstations

Answer

Increase the DHCP lease time on the server VLAN so administrator addresses remain stable for auditing