What is the purpose of segmentation in SD-WAN security?

• A. To consolidate all traffic into a single security domain for performance.
• B. To isolate traffic into security domains, enforcing tailored policies, reducing attack surface, and helping compliance.
• C. To increase network complexity without security benefits.
• D. To replace firewall functionality.

Answer: (B)

Segmentation in SD-WAN security is about isolating traffic into security domains so you can apply tailored policies, reduce the attack surface, and support compliance. By creating boundaries between different parts of the network—such as branches, data centers, cloud segments, and IoT zones—you can enforce specific rules for each area. This means high-sensitivity data or critical applications can have stricter access controls, while less sensitive traffic can use lighter policies, without compromising overall security.

This approach limits lateral movement if a breach occurs, because attackers can’t freely traverse the network from one segment to another. It also makes security management more precise: you can design policies that reflect the risk profile and regulatory requirements of each segment and demonstrate those controls through logs and audits, which supports compliance efforts.

Segmentation works alongside other security tools rather than replacing them. Firewalls, micro-segmentation, and secure tunnels between segments enforce the boundaries and policies, providing structured containment rather than relying on a single, flat security domain.

Choosing options that suggest merging all traffic into one domain, adding complexity without security benefits, or replacing firewall functionality misses the core purpose: creating controlled, policy-driven boundaries to protect data and workloads and to streamline compliance.