Examkin

Question

Difficulty: MediumSecure Network Design and Segmentation

A security engineer is designing the network architecture for a utility company's remote smart grid infrastructure. The environment includes hundreds of field sensor gateways that transmit power usage data back to a centralized analytics server. The engineer must ensure that if an attacker physically tampers with and compromises a field gateway, the attacker cannot move laterally to inspect or access adjacent gateways, nor access administrative systems within the internal enterprise network. Which of the following network segmentation controls best satisfies these security requirements?

  1. Implement microsegmentation and stateful access control rules to restrict East-West traffic between field gateways and restrict North-South communication strictly to designated data collection endpoints.Answer
  2. B
    Place all field sensor gateways and administrative management workstations within a single high-bandwidth Virtual Local Area Network (VLAN) to simplify centralized traffic analysis.
  3. C
    Rely on an upgraded edge perimeter firewall to inspect external internet traffic while allowing unrestricted communication among all internal network nodes once past the perimeter.
  4. D
    Deploy a network intrusion detection system (NIDS) in passive monitoring mode across the field network to serve as the main isolation mechanism.

Answer

Implementing microsegmentation and stateful access control rules to isolate field gateways from one another (limiting East-West lateral movement) and strictly controlling North-South communication to authorized central analytics endpoints.
Microsegmentation isolates workloads and devices from one another, preventing lateral East-West movement even if an attacker physically compromises a device on the network segment. Restricting North-South traffic ensures data can only flow to explicitly authorized analytics servers.

Step-by-Step Solution

1
Analyze the threat model and connectivity requirements.
Field sensor gateways require communication with centralized collection servers (North-South traffic) but should never communicate directly with each other or corporate admin systems (East-West traffic).
Physical exposure makes remote field devices vulnerable to local compromise.
2
Evaluate isolation mechanisms for preventing lateral movement.
Microsegmentation applies fine-grained security policies down to individual device interfaces or workloads, blocking horizontal traversal.
Standard VLANs without microsegmentation or explicit ACLs allow devices on the same segment to communicate freely.
3
Select the optimal architectural decision.
Combining microsegmentation for East-West restriction with stateful rules for North-South flow limits compromise radius effectively.
This enforces Zero Trust network principles by assuming any endpoint may be breached.

Key Concept

Microsegmentation and Lateral Traffic Control
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic