Which type of segmentation divides traffic based on the interface on which a packet is...

Zone segmentation groups traffic based on logical security zones, commonly tied to interfaces or interface groups. A firewall can apply policy depending on the source zone and destination zone, such as trust, untrust, DMZ, data center, or guest. If a packet enters or exits through an interface assigned to a specific zone, that zone becomes part of the policy decision. Port-based segmentation would focus on physical or logical ports, but in firewall security design, zones are the standard construct for interface-based policy grouping. Application segmentation divides traffic based on the application being used. Role-based segmentation uses user or device roles. Zone segmentation is powerful because it allows administrators to express trust boundaries and enforce policy between parts of the network. It is often combined with VLANs, IP subnets, and application-aware controls to create layered segmentation. Reference/topics: Network Security 3.1, zone segmentation; Network Security 3.2, firewall policy enforcement.