Examkin

Question

Difficulty: MediumSecure Network Design and Segmentation

A biotechnology company needs to isolate its laboratory network housing unpatchable legacy gene-sequencing equipment. The laboratory devices must push telemetry data and analysis reports outward to a central server in the enterprise corporate zone, but the security architecture must strictly guarantee that no incoming connection requests or lateral traffic can reach the laboratory network from the corporate zone. Which of the following network controls best fulfills these security constraints?

  1. Deployment of a physical data diode between the laboratory network and the corporate networkAnswer
  2. B
    Configuration of an 802.1Q VLAN trunk linking the laboratory switch directly to the corporate core switch
  3. C
    Implementation of a perimeter firewall configured to trust all internal sessions initiated from the corporate network
  4. D
    Installation of an inline network intrusion detection system (NIDS) on the network segment border

Answer

Deployment of a physical data diode between the laboratory network and the corporate network
The deployment of a physical data diode guarantees hardware-enforced unidirectional communication. This allows the legacy laboratory equipment to send outbound reports while physically preventing any inbound network traffic or cyber attacks from penetrating the laboratory segment.

Step-by-Step Solution

1
Analyze the technical requirements of the scenario
Identified the need to allow outbound telemetry from legacy laboratory systems while enforcing a strict physical block against any inbound connections from the enterprise zone.
Unpatchable legacy systems require high isolation, and software-only firewalls can still present attack surfaces or misconfigurations.
2
Evaluate network segmentation archetypes against the requirement
A data diode uses physical optical connections (such as an LED transmitter to a photodiode receiver) to enforce hardware-based unidirectional communication.
Hardware-level unidirectional enforcement guarantees that no data or packets can traverse in the reverse direction into the critical laboratory zone.

Key Concept

Unidirectional Data Diodes and Secure Network Isolation
Estimated Time:1m 15s
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic