Examkin

Question

Difficulty: HardSecure Network Design and Segmentation

A security architect is designing the network architecture for a manufacturing facility. The site contains a legacy Industrial Control System (ICS) operating sensitive Programmable Logic Controllers (PLCs), alongside an automated telemetry module that needs to push real-time performance metrics to a cloud analytics provider. Enterprise security policy mandates that external cloud systems and corporate IT networks must be strictly prevented from sending incoming traffic back into the ICS network segment. Which of the following network architecture designs best fulfills these security requirements?

  1. Deploy a unidirectional security gateway (data diode) to enforce hardware-based physical layer flow control, permitting outbound telemetry data while physically preventing any inbound network traffic into the ICS environment.Answer
  2. B
    Install a next-generation firewall at the enterprise perimeter and configure an implicit allow rule for all internal East-West traffic originating from corporate workstations toward the ICS subnets.
  3. C
    Create dedicated VLANs for the ICS network on core enterprise switches and use dual-homed jump hosts with dual network interfaces to bridge the ICS and corporate subnets directly.
  4. D
    Position inline Network Intrusion Detection System (NIDS) sensors at the ICS boundary to passively analyze traffic and generate security alerts whenever incoming connections are attempted.

Answer

Deploying a unidirectional security gateway (data diode) to enforce hardware-based physical layer flow control, permitting outbound telemetry data while physically preventing inbound traffic into the ICS environment.
Deploying a unidirectional security gateway (data diode) physically enforces one-way communication at Layer 1. This allows outbound telemetry flow to cloud systems while physically blocking any inbound connection attempts, perfectly satisfying the requirement to isolate critical ICS assets from external network threats.

Step-by-Step Solution

1
Analyze security and architectural requirements
The requirement specifies outbound telemetry data export to the cloud while enforcing a zero-risk policy against inbound network connections into the legacy ICS network segment.
Legacy Industrial Control Systems (ICS/SCADA) and PLCs often lack modern host security controls, making them highly vulnerable to network-based exploits and lateral movement.
2
Evaluate network isolation technologies
A data diode (unidirectional gateway) provides a physical, hardware-based guarantee that data can only travel in one direction.
Unlike software firewalls or VLAN access control lists (ACLs) that could be misconfigured or bypassed via software flaws, a data diode physically lacks the hardware receiver components in the return direction.
3
Eliminate non-compliant isolation mechanisms
Perimeter firewalls with implicit internal trust, dual-homed jump host bridging, and passive NIDS sensors fail to provide non-bypassable unidirectional isolation.
Firewalls and VLANs remain vulnerable to misconfiguration or logical exploits, while NIDS sensors only detect activity rather than preventing inbound connection establishment.

Key Concept

Unidirectional Data Diodes and OT/ICS Network Segmentation
Estimated Time:1m 30s
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic