Examkin

Question

Difficulty: MediumSecure Network Design and Segmentation

A municipal transit authority is deploying connected physical traffic signal controllers deployed across city intersections. The controllers transmit real-time telemetry to a central management server and receive timing synchronization updates. If an attacker gains physical access to a single controller on a street pole, the security team must prevent the attacker from moving laterally to other signal controllers on the network. Which of the following network design strategies best achieves this objective?

  1. Implement microsegmentation and strict access policies to isolate traffic between individual signal controllers.Answer
  2. B
    Place all street signal controllers into a single flat management VLAN protected by a centralized perimeter firewall.
  3. C
    Establish a broad perimeter DMZ that allows unrestricted peer-to-peer traffic among edge controllers for synchronized communication.
  4. D
    Deploy honeypots at each intersection network cabinet to serve as inline preventive filtering controls.

Answer

Microsegmentation and strict access policies should be implemented to restrict traffic between individual signal controllers.
Microsegmentation logically divides network environments into granular isolation zones down to individual workloads or devices. By enforcing strict access policies on East-West traffic, microsegmentation ensures that even if an attacker physically compromises a signal controller at an intersection, they cannot pivot or move laterally to other controllers on the same network segment.

Step-by-Step Solution

1
Identify the primary security requirement in the scenario.
The requirement is preventing lateral movement (East-West traffic traversal) if a physically exposed edge device is compromised.
Physical tampering at an intersection endpoint presents a risk of pivoting across the municipal infrastructure.
2
Evaluate network design isolation strategies.
Microsegmentation creates granular boundaries down to individual device workloads, blocking lateral communications between peer devices.
Standard VLANs or perimeter-only firewalls still allow trusted communication between nodes in the same zone.
3
Select the optimal control mechanism.
Microsegmentation enforces least privilege network access between controllers.
It stops East-West lateral movement directly at the network/workload boundary.

Key Concept

Microsegmentation and East-West Traffic Isolation
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic