A healthcare organization is updating its network architecture to secure legacy medical imaging endpoints (DICOM equipment) that cannot accept local security agents or operating system patches. The operational design requires these endpoints to stream telemetry outbound to an off-site analytics platform while allowing internal system administrators to perform maintenance. Which of the following network architecture and segmentation controls should the security team implement to isolate the legacy endpoints while satisfying operational requirements? (Select TWO.)
- Deploy a physical or virtual data diode at the network perimeter of the legacy medical segment to enforce unidirectional outbound traffic streaming.Answer
- Place legacy medical devices into an isolated VLAN protected by microsegmentation and restrict administrative access strictly through a dedicated jump box with session logging.Answer
- CGroup the legacy medical devices on the general workstation VLAN and rely on host-based firewalls to restrict lateral subnet traffic.
- DConfigure the perimeter Next-Generation Firewall (NGFW) to implicitly permit all internal East-West traffic originating from authenticated Active Directory users.
Answer
The organization should deploy a data diode to enforce unidirectional outbound streaming and place the legacy devices in an isolated VLAN accessible only via a dedicated jump box with microsegmentation controls.
The combination of a data diode and microsegmentation with a jump box ensures complete isolation for unpatchable endpoints. The data diode strictly guarantees one-way outbound data transmission for analytics telemetry without allowing inbound network connections. Microsegmentation isolates the legacy endpoints from general user subnets, while the jump box mandates secure, monitored entry for administrative access.
Step-by-Step Solution
Key Concept
Legacy system network isolation using microsegmentation, jump boxes, and data diodes
Estimated Time:2m 0s