Examkin

Question

Difficulty: EasySecure Network Design and Segmentation

An enterprise facility contains legacy operational technology (OT) devices that cannot receive security updates or support modern encryption protocols. Which network design approach provides the most complete protection by physically isolating these critical devices from all untrusted and corporate network traffic?

  1. Establishing an air-gapped network segment that has no physical or logical interface connections to external networksAnswer
  2. B
    Placing the legacy devices on the main internal local area network while relying on a perimeter firewall for protection
  3. C
    Deploying a network intrusion detection system at the main internet boundary to block malicious traffic heading toward OT devices
  4. D
    Maintaining a flat network architecture while assigning separate IP subnet addresses without VLAN enforcement

Answer

Establishing an air-gapped network segment that has no physical or logical interface connections to external networks is the correct choice.
Air-gapping ensures that a network segment is physically and logically disconnected from all other networks, including internal corporate networks and the internet. For legacy OT equipment that cannot be patched or secured via software, air-gapping provides the strongest possible boundary control.

Step-by-Step Solution

1
Identify the risk and constraint presented in the scenario
The legacy OT systems cannot be patched or upgraded with modern encryption, making them extremely vulnerable to network-based attacks.
Vulnerable systems must be protected using compensating architectural controls when system-level hardening is impossible.
2
Evaluate network isolation techniques for maximum protection
An air gap provides absolute physical and logical separation from internet-connected networks, eliminating direct electronic attack vectors.
Without any physical or logical network interface connecting the networks, remote network exploitation is prevented.

Key Concept

Air-gapping and Network Isolation
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic