Examkin

Question

Difficulty: HardSecure Network Design and Segmentation

A commercial maritime cargo fleet operator is upgrading the network architecture of its oceanic container vessels. Each vessel operates an onboard Integrated Platform Management System (IPMS) that manages engine propulsion, steering control, and ballast sensors. The operations team requires continuous, real-time diagnostic telemetry transmitted from the IPMS to a cloud-based monitoring portal via an onboard satellite communications transceiver. However, strict maritime cybersecurity standards dictate that no inbound communication vectors or return-path network packets may ever reach the critical IPMS control network segment. Which of the following network architecture controls BEST satisfies the operational telemetry requirement while enforcing absolute inbound traffic prevention?

  1. Deploying a unidirectional security gateway (data diode) between the IPMS control segment and the satellite transceiver network.Answer
  2. B
    Configuring software-defined microsegmentation with stateful host firewalls on all IPMS controllers and the satellite router interfaces.
  3. C
    Establishing a hardened dual-homed jump box within a screen subnet (DMZ) to broker outbound SSH telemetry tunnels from the IPMS controllers to the satellite system.
  4. D
    Assigning the IPMS controllers to isolated Private VLAN (PVLAN) ports while setting the satellite gateway port as a promiscuous interface.

Answer

Deploying a unidirectional security gateway (data diode) between the IPMS control segment and the satellite transceiver network is the optimal control.
Deploying a unidirectional security gateway (data diode) provides physical, optical-level single-direction communication. An LED transmitter on the IPMS side sends light signals to a photodiode receiver on the satellite network side without any reverse optical transceiver existing on the cable. This enables continuous outbound telemetry stream exporting while guaranteeing that no inbound packets, exploit payloads, or TCP ACK signals can ever traverse back into the IPMS control zone.

Step-by-Step Solution

1
Analyze the operational and security requirements
Real-time telemetry must flow outbound from the IPMS control segment to the satellite transceiver, but zero inbound communications/packets must be allowed back into the IPMS control segment.
Maritime safety standards require absolute isolation against remote command injection, inbound attacks, or backchannel manipulation of critical propulsion systems.
2
Evaluate candidate network isolation mechanisms against physical vs. logical controls
Logical controls (firewalls, PVLANs, jump servers) preserve bidirectional physical pathways and rely on software configurations, whereas a data diode enforces hardware-based unidirectional data transfer (typically via LED sender and photodiode receiver).
Hardware-enforced unidirectional gateways guarantee that return packets, acknowledgement signals, or inbound exploit attempts are physically blocked at the physical layer.
3
Select the option providing absolute non-reversible isolation
The unidirectional security gateway (data diode) meets both the outbound monitoring requirement and the absolute zero-inbound isolation constraint.
It eliminates the risk of software bypass, misconfiguration, or protocol exploitation that affects purely logical segmentation methods.

Key Concept

Unidirectional Network Security Gateways (Data Diodes) and Industrial Control System (ICS/OT) Segmentation
Estimated Time:2m 0s
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic