Examkin

Question

Difficulty: EasySecure Network Design and Segmentation

A network administrator needs to isolate legacy industrial control devices that cannot accept software patches from the primary corporate network to prevent unauthorized lateral movement. Which of the following network design techniques best fulfills this security requirement?

  1. Placing the legacy devices into a dedicated isolated VLAN with strict firewall access control lists restricting inter-zone communicationAnswer
  2. B
    Placing the legacy devices on the main internal network segment while depending entirely on the perimeter firewall to inspect incoming internet traffic
  3. C
    Deploying host-based endpoint security agents on the legacy devices while keeping them on the general workstation subnet
  4. D
    Connecting the legacy devices directly to the core network router with dynamic routing enabled to increase throughput

Answer

Placing the legacy devices into a dedicated isolated VLAN with strict firewall access control lists restricting inter-zone communication
Placing legacy devices into a dedicated, isolated VLAN enforced by firewall rules restricts network traffic to only authorized communication paths, preventing lateral threat movement across the internal network.

Step-by-Step Solution

1
Identify the primary risk described in the scenario
Unpatchable legacy devices on a network create a risk of lateral movement if compromised.
Legacy devices often lack modern security controls and vendor patch support.
2
Determine the appropriate network architecture control
Network segmentation via VLANs and firewall ACLs isolates high-risk assets into specific zones.
Segmentation restricts network traffic flow, preventing unauthorized internal access to and from sensitive or vulnerable systems.

Key Concept

Network Segmentation and Isolation
Estimated Time:45s
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic