TL;DR: A VLAN separates traffic and contains broadcast domains, providing enforced layer-2 isolation. It does not determine which routed inter-VLAN flows are authorized. Segmentation becomes security only when inter-zone traffic crosses a policy enforcement point that filters it. Flat layer 2 with a permissive router gives you the label of segmentation and none of the control.
How to approach it
Answer with the distinction immediately, because this question screens whether you confuse topology with policy. Then ground it: what VLANs buy, where the claim collapses, and the four additions that make segmentation real.
A strong answer
What a VLAN buys: hosts on different VLANs cannot talk at layer 2 at all, broadcast domains stay separate, ARP spoofing and sniffing are confined to your own segment, while shared switches and links can still suffer resource exhaustion. That containment has genuine value and compliance frameworks expect it: PCI DSS scoping leans on segmentation to keep adequately isolated non-cardholder systems out of the cardholder-data environment’s scope, and OT or manufacturing networks get walled off this way as standard practice.
Where the security claim collapses: inter-VLAN traffic rides a router, and a permissive routing/ACL configuration can allow unwanted lateral access. Every workstation sits one ACL-less hop from the server VLAN. Add switch-level sloppiness, trunk ports negotiated automatically, default native VLAN in use, unused ports live, and VLAN hopping becomes a risk to test against the actual switch configuration. The honest position: VLANs are compartment walls, and walls without checkpoints are decoration.
Segmentation earns the name when you add four things. Enforcement between zones: firewall or ACLs at every inter-VLAN boundary, default-deny on the flows that matter, management reachable only through a jump network. Switch hygiene: shut unused ports, disable trunk auto-negotiation on host ports, dedicated native VLAN or tagged-only trunks. Admission control for who joins at all, 802.1X where the estate supports it. Observability of east-west flows, so you learn what the boundaries break before an outage teaches you.
A zone model worth defending in an enterprise:
| Zone | Contains | Boundary rule |
|---|---|---|
| Management | switches, hypervisors, IPMI | jump host only |
| Production | applications, databases | app ports inbound, nothing outbound unsolicited |
| Corporate | laptops, workstations | selected app ports only |
| Guest and IoT | visitors, printers, cameras | internet egress only |
Zero trust does not retire this model, it layers identity-aware controls on top of it. Devices that can hold no identity, cameras, printers, baseboard controllers, still need compartments, and microsegmentation projects land faster when coarse zone boundaries already exist.
PCI segmentation guidance requires effective separation when segmentation is used to reduce scope.
What interviewers probe next
"Explain VLAN hopping." Two variants: switch spoofing, where an attacker negotiates a trunk via DTP, and double-tagging, where a crafted frame crosses two VLANs in one hop. Mitigations overlap: disable auto-trunking on access ports, avoid a shared native VLAN, shutdown unused ports.
"Flat network, 500 servers, limited budget. Where do you start?" Around the crown jewels, not everywhere. Put the enforcement point between corporate users and the most valuable systems first, observe which allowed flows actually fire, then tighten. Boiling the ocean stalls at month three and delivers nothing.
"Does cloud make this obsolete?" The mechanism changes, VPCs, subnets and security groups replace VLANs, but the principle transfers exactly: separate zones with explicit, controlled crossings.
Common mistakes
Answering yes or no flatly. Both lose: yes ignores the missing enforcement, no dismisses containment value that is real.
Claiming segmentation while the router passes everything, which is the most common finding in actual enterprise assessments.
Forgetting the management plane: an exposed management VLAN undoes every other boundary, because that is where the switches themselves get configured.