Examkin

Question

Difficulty: HardSecure Network Design and Segmentation

A security architect for an electrical power distribution utility is designing network security controls for an operational technology (OT) environment. Remote vendor engineers require targeted maintenance access to programmable logic controllers (PLCs) located within the high-security Control Zone. The solution must ensure that remote connections never terminate directly inside the OT segment, prevent lateral movement between distinct PLC subnets, and log all session activity at the network boundary. Which of the following network architecture designs best fulfills these requirements?

  1. Deploy an intermediate jump box inside an OT DMZ enforcing multi-factor authentication, paired with microsegmentation policies that restrict East-West traffic between individual PLC subnets.Answer
  2. B
    Place all PLCs and vendor maintenance workstations on a single dedicated VLAN while relying on a Next-Generation Firewall at the corporate WAN edge to inspect and filter inbound vendor traffic.
  3. C
    Establish a strict physical air gap for the Control Zone while configuring local host-based software firewalls on each PLC to restrict access to authorized vendor IP ranges.
  4. D
    Install an inline Network Intrusion Prevention System at the OT perimeter configured to dynamically reassign non-compliant vendor sessions to a quarantined honeynet segment.

Answer

The optimal design deploys an intermediate jump box within an OT DMZ enforcing multi-factor authentication and session proxying, combined with microsegmentation policies to control East-West traffic between PLC subnets.
The design utilizing an intermediate jump server within a dedicated OT DMZ ensures that external maintenance sessions terminate in a constrained zone prior to accessing target PLCs. Combined with microsegmentation policies between PLC subnets, North-South entry is strictly controlled and audited, while East-West lateral movement between PLCs is blocked.

Step-by-Step Solution

1
Evaluate the requirement to prevent direct inbound WAN connections into the high-security Control Zone.
Identify that an intermediate bastion/jump box residing in an isolated DMZ must terminate incoming remote sessions before initiating a second authenticated session into the OT zone.
Direct connections from lower-trust networks (corporate WAN/Internet) to critical OT control assets violate secure architecture principles.
2
Evaluate the requirement to prevent lateral movement within the OT environment.
Implement microsegmentation around individual PLC subnets to strictly govern East-West (peer-to-peer) communications.
Flat VLAN structures allow compromised nodes or vendor sessions to scan and attack adjacent industrial assets.
3
Synthesize the architecture controls to select the option that combines DMZ transit proxying with internal microsegmentation.
The architecture incorporating an OT DMZ jump server with granular microsegmentation policies completely satisfies both North-South boundary protection and East-West containment.
It achieves Zero Trust network access control across both external boundary boundaries and internal zones.

Key Concept

Secure Network Design and Segmentation for OT/SCADA Environments
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic