Examkin

Question

Difficulty: HardSecure Network Design and Segmentation

An enterprise airport operations authority is redesigning its security architecture across operational technology (OT), cloud management, tenant infrastructure, and administrative networks. Match each network isolation and control mechanism on the left to its corresponding architectural requirement on the right.

  • Unidirectional Data DiodeRestricts data transfer strictly to outbound telemetry from SCADA monitoring networks to cloud reporting without allowing any inbound packets.
  • Microsegmentation with Host-based EnforcementPrevents East-West lateral movement between individual containerized microservices within the same cloud virtual private cloud (VPC).
  • Hardened Jump Server with MFA and Session AuditingProvides secure, monitored access for external vendors managing privileged internal subnets over untrusted networks.
  • Physical Air Gap with Media Sanitization KioskIsolates safety-critical runway automated control hardware entirely from external networks while maintaining offline patch capability.

Answer

Unidirectional Data Diode pairs with outbound-only SCADA telemetry; Microsegmentation pairs with stopping East-West lateral movement between cloud microservices; Hardened Jump Server pairs with audited vendor administrative access; Physical Air Gap pairs with isolating critical runway control hardware via offline media ingestion.
Each isolation mechanism aligns with specific threat model requirements: data diodes physically enforce one-way telemetry streaming; microsegmentation controls internal lateral movement across cloud workloads; jump servers control and audit remote management access; air gaps eliminate all network-based attack vectors against critical physical control systems.

Step-by-Step Solution

1
Evaluate hardware-enforced single-direction communication constraints.
Identify that streaming telemetry outbound while physically blocking inbound traffic requires a Unidirectional Data Diode.
Data diodes utilize physical optical transmitters and receivers that prevent electromagnetic or logical return channels.
2
Evaluate lateral communication controls for cloud workloads.
Match Microsegmentation to the requirement of limiting East-West traffic between individual containerized instances.
Traditional perimeter firewalls cannot inspect or restrict peer-to-peer traffic inside the same virtual layer 2 network segment without software-defined microsegmentation.
3
Evaluate privileged remote management architectures.
Match Hardened Jump Server with MFA and Session Auditing to third-party vendor administrative access requirements.
Jump boxes isolate external administrative sessions from internal infrastructure while recording session activity for compliance and forensics.
4
Evaluate total isolation controls for high-consequence OT infrastructure.
Match Physical Air Gap with Media Sanitization Kiosk to the safety-critical automated runway control systems.
Complete physical separation removes external connectivity attack vectors, using controlled offline kiosks as the sole ingestion path for maintenance files.

Key Concept

Network Segmentation and Isolation Architecture Controls
Estimated Time:2m 0s
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic