Examkin

Question

Difficulty: MediumSecure Network Design and Segmentation

A logistics enterprise is integrating automated freight crane telemetry sensors with its centralized monitoring dashboard. The crane control systems run legacy industrial software that cannot be patched, whereas the monitoring dashboard resides on the corporate administrative network. Which network design control best mitigates the risk of lateral threat movement from the corporate network to the crane controllers while continuing to permit automated telemetry collection?

  1. Deploying microsegmentation with strict firewall stateful rules that enforce unidirectional traffic flow from the crane network zone to the monitoring dashboardAnswer
  2. B
    Relying on a perimeter edge firewall to inspect all North-South internet traffic entering the corporate network gateway
  3. C
    Enforcing a complete physical air gap around the crane controllers that restricts all network connections and requires manual USB data collection
  4. D
    Categorizing the monitoring dashboard as a detective security control and placing corporate workstations and crane controllers within a single local VLAN domain

Answer

Deploying microsegmentation with strict firewall stateful rules that enforce unidirectional traffic flow from the crane network zone to the monitoring dashboard.
Microsegmentation paired with unidirectional stateful filtering allows data to be sent from the critical operational zone to the dashboard zone while blocking any inbound access requests initiated from the administrative network toward the vulnerable legacy crane controllers.

Step-by-Step Solution

1
Analyze the functional requirements and security constraints of the operational environment.
Real-time telemetry data must flow out from the crane controllers to the corporate dashboard, but legacy controllers must be shielded from incoming connections.
Legacy systems are vulnerable to exploit attempts if reachable over the network.
2
Evaluate network architecture controls against threat vectors.
Microsegmentation establishes granular control boundaries around the industrial controllers, allowing outbound telemetry traffic while blocking inbound connections from the corporate network.
Restricting session initiation prevents compromised corporate workstations from moving laterally into the industrial control environment.

Key Concept

Microsegmentation and zone isolation for operational technology (OT) systems
Estimated Time:1m 30s
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic