Examkin

Question

Difficulty: Very hardSecure Network Design and Segmentation

A biomedical research facility hosts legacy laboratory automation equipment running unpatchable operating systems. The facility must export real-time telemetry data from these legacy systems to an internal analytics data lake while simultaneously granting temporary remote access to an off-site maintenance vendor. Which of the following network architecture designs best isolates the legacy equipment while enabling these required operational functions?

  1. Implement an isolated Operational Technology VLAN protected by an inline next-generation firewall enforcing microsegmentation, route vendor maintenance through a privileged jump box with multi-factor authentication inside a dedicated management DMZ, and install an unidirectional security gateway (data diode) for telemetry export.Answer
  2. B
    Place the legacy automation equipment and vendor maintenance systems into a shared perimeter DMZ behind a stateful firewall, permitting bidirectional communication to the internal data lake using port forwarding rules.
  3. C
    Apply network address translation (NAT) with private IP addressing to the legacy equipment VLAN while configuring direct SSH tunnel access from the vendor endpoint straight into the legacy network segment.
  4. D
    Deploy a passive network intrusion detection system (NIDS) tap across the legacy network switch to automatically block unauthorized cross-zone connections and encrypt outbound legacy packet payloads.

Answer

The optimal design implements an isolated Operational Technology VLAN with microsegmentation, routes vendor access through a secure jump box in a management DMZ, and uses an unidirectional security gateway (data diode) for data export.
The design providing an isolated OT VLAN with inline microsegmentation, an unidirectional data diode for outbound telemetry export, and a mediated jump host in a management DMZ for vendor maintenance enforces defense-in-depth and strict zone isolation required for legacy unpatchable systems.

Step-by-Step Solution

1
Analyze isolation requirements for legacy/unpatchable systems
Legacy unpatchable systems require maximum microsegmentation and strict outbound-only or mediated access controls to prevent compromised lateral propagation.
Unpatchable endpoints are critical vulnerabilities if exposed directly to external networks or unmonitored internal zones.
2
Evaluate telemetry data export controls
An unidirectional security gateway (data diode) guarantees hardware-enforced one-way data transfer from the legacy OT VLAN to the analytics data lake.
Data diodes physically prevent any inbound communication or attack vectors from originating from the data lake back into the legacy zone.
3
Evaluate remote third-party management controls
Vendor access is routed through a dedicated jump box (bastion host) in a management DMZ enforcing multi-factor authentication and session monitoring.
Direct remote access into sensitive network segments breaks zoning principles; jump boxes mediate and audit all administrative sessions.

Key Concept

Secure Network Architecture and OT/Legacy System Segmentation
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic