Examkin

Question

Difficulty: EasySecure Network Design and Segmentation

A security administrator needs to prevent smart building environmental sensors from communicating directly with internal servers holding confidential employee files on the company network. Which of the following secure network design techniques provides the most effective logical isolation for these sensors?

  1. Placing the sensors on a dedicated Virtual Local Area Network (VLAN) with restricted inter-VLAN routingAnswer
  2. B
    Relying on the edge perimeter firewall to block external inbound traffic to the internal server network
  3. C
    Configuring static port forwarding rules on the default gateway router
  4. D
    Deploying an inline load balancer across public network segments

Answer

Placing the sensors on a dedicated Virtual Local Area Network (VLAN) with restricted inter-VLAN routing is the most effective approach for logically isolating IoT devices from sensitive internal resources.
Placing smart building sensors on a dedicated Virtual Local Area Network (VLAN) isolates their traffic into a distinct logical broadcast domain. With inter-VLAN routing rules or firewalls configured between subnets, lateral movement from compromised IoT devices to confidential internal servers is blocked.

Step-by-Step Solution

1
Identify the risk and segmentation requirement.
The smart sensors represent untrusted or low-security devices that share network access with high-value internal servers.
Unsecured IoT devices can be leveraged as entry points to laterally move across flat internal networks.
2
Evaluate network isolation techniques.
Creating a dedicated VLAN partitions the network at Layer 2/Layer 3, isolating broadcast domains.
Logical segmentation via VLANs coupled with firewall access control lists (ACLs) enforces boundary controls on internal traffic.

Key Concept

Logical Network Segmentation using VLANs
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic