Segmentation and Triage Drill
Key Takeaways
Segmentation limits what a problem can reach (subdomain 4.2).
Triage ranks events by priority, scope, and urgency (subdomain 5.2).
Choose the response that contains the event within its segment.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomains 4.2 and 5.2, checked 2026-10-22.
The Drill
A monitoring alert shows unusual traffic from a development segment toward production. Segmentation tells you which zones should not connect (subdomain 4.2). Triage tells you how urgent the event is (subdomain 5.2). The best response contains the event within its zone and escalates for review.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomains 4.2 and 5.2, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 4.2: Network segmentation (e.g., firewall zones, VLAN, micro-segmentation)
- 4.2: Defense in Depth
- 4.2: Zero Trust (ZT)
- 5.2: Logging and monitoring security events
- 5.2: Security event triage (e.g., incident use cases, prioritization, correlation)
- 5.2: Threat actors (e.g., types, motivations)
- 5.2: Cyber threat intelligence
- 5.2: Threat frameworks
Common Traps
A common trap is treating a single strong control as defense in depth. The concept depends on several layers, and Zero Trust depends on checking each access rather than trusting a network location.
Traffic from a development segment is trying to reach production. What is the best first response?
Contain the traffic within its segment and escalate for review
Open the production network to the development segment so the work can continue without any delay
Ignore the alert because development is trusted and the traffic is most likely a scheduled job
Delete all logs for both segments so that the investigation has less data to review afterward
Working the Drill
Read the scenario in two passes. In the first pass, identify which zones should be separated and whether traffic crosses between them. In the second pass, rank the event with triage: which event is most urgent, what is its scope, and what correlates with it. The best answer contains the event within its zone and escalates the highest-priority item for review.
Sections you finish are checked off in the contents.