The big idea: Segmentation splits one network into smaller separate ones.
Traffic stays inside its own segment, so there is less of it everywhere — and a machine in one segment cannot simply reach a machine in another.
Two reasons, always: Performance — less traffic competing on any one segment.
Security — a break-in or an infection is contained where it started, instead of reaching the whole organisation.
Free preview
This is the free notes preview
You're reading the free notes. Aimnova Pro unlocks the full study experience — and you can try it with your first topic free to keep:
- FlashcardsLock in vocabulary and key terms with spaced repetition.
- Practice questionsAnswer exam-style questions and get instant AI marking.
- Mock exams & past-paper vaultSit full mocks and see exactly how examiners award marks.
- Personalised study planA daily plan built around your exam date and weak areas.
Subnetting
- Divides the IP address range into smaller ranges
- Each subnet is its own network as far as IP is concerned
- Traffic between subnets must pass through a router
- That router is where rules can be enforced
VLANs
- Groups devices logically, regardless of where they are plugged in
- Configured on the switch, not by moving cables
- Two machines in one room can sit on different VLANs
- Moving someone between groups is a setting, not a rewiring job
What they share
- Traffic is kept inside its group
- Crossing groups is controlled, not automatic
- Congestion drops because fewer devices share a segment
- A compromise is contained rather than spreading
The difference in one line: Subnetting divides by address. VLANs divide by which group you belong to, whatever your address or your socket.
Organisations usually do both: a VLAN per department, each on its own subnet.
See how examiners mark answers
Answer exam-style questions with model answers. Learn exactly what earns marks and what doesn't.
Less congestion
In one flat network, broadcast traffic reaches every device.
Split it into six segments and each device sees roughly a sixth as much — so the same cabling carries useful work instead of noise.
Contained damage
Malware on one machine can only spread as far as its own segment reaches.
A guest laptop on the visitor VLAN cannot touch the finance servers at all, because nothing routes between them.
Rules where segments meet
Traffic crossing between segments passes through a router or firewall, which is a natural place to apply rules.
Inside a flat network there is no such point — everything can already reach everything.
Resources where they are needed
A segment carrying patient monitoring or video can be given priority and its own capacity.
Without segmentation, that traffic competes with everything else on equal terms.
What it costs: Segmentation has to be designed and maintained. Wrong rules block work that should be allowed; forgotten rules leave gaps.
And every crossing adds a routing step, which adds a little delay.
How this is tested — you must give BOTH reasons — performance and security — and show how one mechanism delivers them. It comes up two ways:
Paper 1 Section A
- Explain segmentation and its purpose, 3-5 marks
- Distinguish subnetting from VLANs
- Say why an organisation would segment
Paper 1 Section B — case study
- Recommend segmentation for the case study
- Explain which groups should be separated and why
The classic trap: Giving only the security reason. Segmentation is asked about as much for congestion as for containment — an answer with one reason caps itself at half marks.
A hospital wants guest wi-fi, staff computers and patient monitoring equipment on the same physical network. Explain how segmentation would help.
Model answer plan
See the answer broken into clear points, with guidance on how each point earns marks.