Examkin

Question

Difficulty: Very hardSecure Network Design and Segmentation

An industrial engineering firm operates a critical water treatment facility utilizing legacy Programmable Logic Controllers (PLCs) within an Operational Technology (OT) control zone. The organization must transmit continuous operational metrics to a cloud-based Enterprise Resource Planning (ERP) analytics platform. The security architecture team must ensure that telemetry data moves out of the OT environment while physically preventing any inbound control signals, command injection, or unauthorized network traffic from reaching the legacy PLCs. Which of the following network segmentation designs best achieves this objective?

  1. Deploying a unidirectional security gateway (data diode) at the OT-to-IT boundary to physically restrict data flow exclusively outbound toward a staging broker in the enterprise DMZ.Answer
  2. B
    Configuring a Next-Generation Firewall (NGFW) at the OT boundary with stateful packet inspection to permit outbound TCP session creation while relying on connection state tables to trust return traffic.
  3. C
    Installing a dual-homed jump server bridging the OT control zone and the corporate IT network to route and inspect telemetry traffic before forwarding it to the cloud environment.
  4. D
    Implementing an inline network intrusion detection system (NIDS) operating as a detective control at the enterprise gateway to alert administrators to unauthorized inbound OT commands.

Answer

Deploying a unidirectional security gateway (data diode) at the OT-to-IT boundary to physically restrict data flow exclusively outbound toward a staging broker in the enterprise DMZ.
Deploying a unidirectional security gateway (data diode) provides physical, optical enforcement of one-way network traffic flow. This permits operational metrics to leave the OT environment while making it physically impossible for incoming signals, commands, or exploit payloads to reach legacy PLCs.

Step-by-Step Solution

1
Analyze the security and operational requirements
Identified the requirement for one-way outbound data egress (OT telemetry to cloud analytics) with zero possibility of inbound network traffic, command injections, or reverse connections to legacy PLCs.
Legacy OT/ICS devices often lack modern security controls and patch capabilities, making any inbound communication path a high-risk vector for cyber-attacks.
2
Evaluate candidate network isolation and segmentation technologies
Standard firewalls and jump servers permit bidirectional IP layer communication. Data diodes enforce unidirectional transmission at the physical layer (Layer 1).
Physical enforcement via optical transmitters and receivers prevents any protocol-level return path or handshake from traversing back into the protected segment.
3
Select the optimal architecture matching the strict boundary constraint
Confirmed that a data diode paired with a DMZ staging broker satisfies continuous telemetry export while enforcing absolute physical isolation against inbound traffic.
This design adheres to strict OT/IT segmentation standards (such as IEC 62443 / Purdue Model Level 3 to Level 4 separation).

Key Concept

Unidirectional Network Gateways (Data Diodes) and OT/IT Network Segmentation
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic