---
title: "Subnet — AP Cybersecurity Definition & Exam Guide"
description: "A subnet is a logical division of a larger network into smaller segments, a core idea behind network segmentation in AP Cybersecurity Unit 3 for limiting lateral movement."
canonical: "https://fiveable.me/ap-cybersecurity/key-terms/subnet"
type: "key-term"
subject: "AP Cybersecurity"
unit: "Unit 3"
---

# Subnet — AP Cybersecurity Definition & Exam Guide

## Definition

In AP Cybersecurity, a subnet is a smaller, logically divided portion of a larger IP network. Splitting a network into subnets is a form of network segmentation that limits how far an adversary can move after compromising one device.

## What It Is

A subnet is a chunk of a bigger network that's been sliced off and given its own range of [IP addresses](/ap-cybersecurity/unit-3/detecting-network-attacks/study-guide/5kYH3dgJpqFp57SUnjEX "fv-autolink"). Think of one giant office network broken into smaller, walled-off neighborhoods. Devices inside the same subnet can talk to each other directly, while traffic between subnets has to pass through a router or default gateway, where you can apply rules and filtering.

Why bother slicing things up? Because a flat network where everything can reach everything is a security nightmare. If an [adversary](/ap-cybersecurity/key-terms/adversary "fv-autolink") compromises one device, they can try to **move laterally** to reach more sensitive systems on the same LAN (EK 3.1.B.2). Subnetting puts boundaries between groups of devices, so a foothold in one area doesn't automatically grant access to the whole network. It's the practical building block of network segmentation, which is one of the main defenses [Unit 3](/ap-cybersecurity/unit-3 "fv-autolink") cares about.

## Why It Matters

Subnets live in **Unit 3: Securing Networks**, anchored to topic 3.1 (Network Vulnerabilities and Attacks). The term supports **[AP Cybersecurity](/ap-cybersecurity "fv-autolink") 3.1.B**, where you explain how adversaries exploit network weaknesses, and **AP Cybersecurity 3.1.C**, where you assess the risks those weaknesses create. The big connection is EK 3.1.B.2 and EK 3.1.C.1: once an attacker compromises a device, they try to pivot to others on the LAN. [Subnetting](/ap-cybersecurity/key-terms/subnetting "fv-autolink") and segmentation are how you box them in. This ties directly into the CIA triad, since limiting lateral movement protects the confidentiality, integrity, and availability of sensitive systems.

## Connections

### [Network Segmentation (Unit 3)](/ap-cybersecurity/key-terms/network-segmentation)

Subnetting is segmentation in action. [Network segmentation](/ap-cybersecurity/key-terms/network-segmentation "fv-autolink") is the strategy of breaking a network into isolated parts, and creating subnets is one of the most common ways you actually do it. Same idea, different zoom level.

### Lateral Movement on a LAN (Unit 3)

EK 3.1.B.2 says [adversaries](/ap-cybersecurity/unit-3/network-vulnerabilities-and-attacks/study-guide/9lJpNM0eCHQ1M3XgFL97 "fv-autolink") who compromise one device try to reach others on the LAN. Subnets are the speed bumps that slow this down, because crossing into another subnet means passing through a gateway where filtering can stop them.

### [Screened Subnet (Unit 3)](/ap-cybersecurity/key-terms/screened-subnet)

A [screened subnet](/ap-cybersecurity/key-terms/screened-subnet "fv-autolink") (sometimes called a DMZ) is a special subnet placed between the internet and your internal network, guarded by firewalls. It's a subnet built specifically to hold public-facing servers without exposing the rest of your LAN.

### [VLAN (Unit 3)](/ap-cybersecurity/key-terms/vlan)

A VLAN does for switch ports what a subnet does for IP addresses. They often work together to logically separate devices that share the same physical hardware, both serving the segmentation goal.

## On the AP Exam

Subnet shows up as a supporting concept rather than a standalone definition. On multiple-choice questions, expect it in scenarios about stopping an attacker from reaching sensitive systems, where segmenting the network into subnets is the correct mitigation. On free response, if you're asked to recommend defenses against lateral movement (EK 3.1.B.2) or to reduce risk from a network vulnerability (EK 3.1.C.1), naming subnetting or network segmentation as a control is a solid, CED-aligned answer. The move you want to make: connect subnets to limiting blast radius, not just to organizing IP addresses.

## subnet vs VLAN

A subnet is a Layer 3 (IP-based) division using IP address ranges, while a VLAN is a Layer 2 (switch-based) division that logically groups switch ports. They both separate devices, but a subnet operates by IP addressing and a VLAN operates on the switch itself. In practice they're often paired, with each VLAN mapped to its own subnet.

## Key Takeaways

- A subnet is a smaller, logically divided portion of a larger IP network, and traffic between subnets must pass through a router or gateway.
- Subnetting is a practical form of network segmentation, the main Unit 3 defense for boxing in attackers.
- Its biggest security payoff is limiting lateral movement, so compromising one device doesn't expose the whole LAN (EK 3.1.B.2).
- By restricting how far an adversary can reach, subnets help protect confidentiality, integrity, and availability (EK 3.1.C.1).
- A subnet divides by IP address (Layer 3), while a VLAN divides by switch port (Layer 2), and they're often used together.
- A screened subnet is a special subnet that isolates public-facing servers between the internet and your internal network.

## FAQs

### What is a subnet in AP Cybersecurity?

A subnet is a smaller logical division of a larger IP network. In Unit 3, it matters because splitting a network into subnets is a form of segmentation that limits how far an attacker can move after breaking into one device.

### Is subnetting the same as network segmentation?

Not exactly, but they're closely related. Network segmentation is the overall goal of isolating parts of a network, and subnetting is one of the most common ways to achieve it. Think of subnetting as segmentation done with IP address ranges.

### How is a subnet different from a VLAN?

A subnet separates devices by IP address at Layer 3, while a VLAN separates them by switch port at Layer 2. Both isolate devices for security, and they're frequently used together, with each VLAN matched to its own subnet.

### Why do subnets help stop attackers?

Because traffic moving between subnets has to pass through a gateway where you can filter or block it. This slows or stops lateral movement (EK 3.1.B.2), so an attacker who compromises one device can't freely reach sensitive systems on another subnet.

### What is a screened subnet?

A screened subnet, also called a DMZ, is a subnet placed between the internet and your internal network and guarded by firewalls. It hosts public-facing servers so outside users can reach them without gaining access to the rest of your LAN.

## Related Study Guides

- [3.1 Network Vulnerabilities and Attacks](/ap-cybersecurity/unit-3/network-vulnerabilities-and-attacks/study-guide/9lJpNM0eCHQ1M3XgFL97)

## Structured Data

```json
{"@context":"https://schema.org","@graph":[{"@type":"LearningResource","@id":"https://fiveable.me/ap-cybersecurity/key-terms/subnet#resource","name":"Subnet — AP Cybersecurity Definition & Exam Guide","url":"https://fiveable.me/ap-cybersecurity/key-terms/subnet","learningResourceType":"Concept explainer","educationalLevel":"AP® / High School","about":{"@id":"https://fiveable.me/ap-cybersecurity/key-terms/subnet#term"},"audience":{"@type":"EducationalAudience","educationalRole":"student"},"dateModified":"2026-06-15T18:59:30.460Z","isPartOf":{"@type":"Collection","name":"AP Cybersecurity Key Terms","url":"https://fiveable.me/ap-cybersecurity/key-terms"},"publisher":{"@type":"Organization","name":"Fiveable","url":"https://fiveable.me"}},{"@type":"DefinedTerm","@id":"https://fiveable.me/ap-cybersecurity/key-terms/subnet#term","name":"subnet","description":"In AP Cybersecurity, a subnet is a smaller, logically divided portion of a larger IP network. Splitting a network into subnets is a form of network segmentation that limits how far an adversary can move after compromising one device.","url":"https://fiveable.me/ap-cybersecurity/key-terms/subnet","inDefinedTermSet":{"@type":"DefinedTermSet","name":"AP Cybersecurity Key Terms","url":"https://fiveable.me/ap-cybersecurity/key-terms"},"educationalAlignment":[{"@type":"AlignmentObject","alignmentType":"educationalSubject","educationalFramework":"AP® Course and Exam Description","targetName":"AP Cybersecurity Unit 3, Topic 3.1, LO 3.1.A"},{"@type":"AlignmentObject","alignmentType":"educationalSubject","educationalFramework":"AP® Course and Exam Description","targetName":"AP Cybersecurity Unit 3, Topic 3.1, LO 3.1.B"},{"@type":"AlignmentObject","alignmentType":"educationalSubject","educationalFramework":"AP® Course and Exam Description","targetName":"AP Cybersecurity Unit 3, Topic 3.1, LO 3.1.C"}]},{"@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is a subnet in AP Cybersecurity?","acceptedAnswer":{"@type":"Answer","text":"A subnet is a smaller logical division of a larger IP network. In Unit 3, it matters because splitting a network into subnets is a form of segmentation that limits how far an attacker can move after breaking into one device."}},{"@type":"Question","name":"Is subnetting the same as network segmentation?","acceptedAnswer":{"@type":"Answer","text":"Not exactly, but they're closely related. Network segmentation is the overall goal of isolating parts of a network, and subnetting is one of the most common ways to achieve it. Think of subnetting as segmentation done with IP address ranges."}},{"@type":"Question","name":"How is a subnet different from a VLAN?","acceptedAnswer":{"@type":"Answer","text":"A subnet separates devices by IP address at Layer 3, while a VLAN separates them by switch port at Layer 2. Both isolate devices for security, and they're frequently used together, with each VLAN matched to its own subnet."}},{"@type":"Question","name":"Why do subnets help stop attackers?","acceptedAnswer":{"@type":"Answer","text":"Because traffic moving between subnets has to pass through a gateway where you can filter or block it. This slows or stops lateral movement (EK 3.1.B.2), so an attacker who compromises one device can't freely reach sensitive systems on another subnet."}},{"@type":"Question","name":"What is a screened subnet?","acceptedAnswer":{"@type":"Answer","text":"A screened subnet, also called a DMZ, is a subnet placed between the internet and your internal network and guarded by firewalls. It hosts public-facing servers so outside users can reach them without gaining access to the rest of your LAN."}}]},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"AP Cybersecurity","item":"https://fiveable.me/ap-cybersecurity"},{"@type":"ListItem","position":2,"name":"Key Terms","item":"https://fiveable.me/ap-cybersecurity/key-terms"},{"@type":"ListItem","position":3,"name":"Unit 3","item":"https://fiveable.me/ap-cybersecurity/unit-3"},{"@type":"ListItem","position":4,"name":"subnet"}]}]}
```