Examkin

Question

Difficulty: MediumSecure Network Design and Segmentation

An enterprise organization is deploying IoT-enabled environmental monitoring sensors throughout its server infrastructure rooms. The sensors require outbound HTTPS communication to a third-party vendor's cloud telemetry platform for automated threshold alerting. However, security policy mandates that these IoT devices must be strictly restricted to prevent lateral movement toward core internal network assets in the event a sensor is compromised. Which of the following network architecture designs best meets these security requirements while enforcing least privilege?

  1. Isolate the environmental sensors on a dedicated VLAN using microsegmentation policies and strict egress filtering that restricts outbound traffic exclusively to the cloud platform's endpoints.Answer
  2. B
    Place the environmental sensors on the primary internal subnet alongside corporate database servers, relying on the boundary firewall to filter inbound internet threats.
  3. C
    Connect the environmental sensors to an air-gapped network segment that lacks routing capabilities or internet connectivity.
  4. D
    Deploy the environmental sensors inside the perimeter DMZ as a compensating control to prevent unauthorized internal access.

Answer

Placing the sensors on a dedicated VLAN governed by microsegmentation and restricted egress filtering provides the necessary network isolation and outbound connectivity.
Microsegmentation combined with a dedicated VLAN and strict egress firewalls isolates high-risk IoT devices from internal networks while allowing only necessary outbound connections to specified cloud servers.

Step-by-Step Solution

1
Analyze functional network communication requirements
Sensors must reach external cloud endpoints over HTTPS (TCP/443).
Air-gapping or completely disabling internet egress breaks required telemetry capabilities.
2
Analyze internal threat mitigation and containment requirements
Internal lateral movement toward corporate data must be blocked.
IoT devices are frequent breach vectors and must be strictly isolated from core subnets.
3
Select network architecture control enforcing least privilege
Combine dedicated VLAN segmentation, microsegmentation policies, and strict egress filtering.
This configuration restricts East-West lateral movement and enforces explicit North-South egress traffic control.

Key Concept

Secure Network Design and Microsegmentation
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic