N10-009 Question 259
Select 2A manufacturing company is modernizing its plant network. The environment includes SCADA servers, PLCs on an OT network, badge readers and IP cameras classified as IoT, contractor tablets used for maintenance, employee BYOD phones, and a guest wireless network for vendors. The company must reduce the risk that a compromised guest or BYOD device could reach industrial control systems, while still allowing authorized maintenance traffic to the OT environment through approved systems. Which TWO actions best enforce proper network segmentation? (Choose two.)
- A
Place SCADA servers and PLCs in a dedicated OT/ICS VLAN or zone and restrict access to only required ports and approved jump hosts using ACLs or firewall rules
- B
Connect guest wireless and employee BYOD devices to the same subnet as IoT devices, but require a stronger WPA3 passphrase
- C
Use separate SSIDs/VLANs for guest and BYOD networks with policies that deny direct access to OT/ICS segments
- D
Allow contractor tablets to connect directly to PLC management interfaces from the guest network when troubleshooting is needed
- E
Move badge readers and IP cameras into the OT/ICS VLAN so all operational equipment is on one broadcast domain
Show answer and explanation
Correct answers: A, C
Explanation
The best answers are to isolate industrial control assets in a dedicated OT/ICS zone and to separately segment guest and BYOD networks so they cannot directly reach that zone. In practice, Network+ expects candidates to recognize that segmentation is enforced with tools such as VLANs, ACLs, firewall rules, SSIDs, and controlled access paths. For industrial environments, best practice is to avoid flat networks and instead use security zones and conduits, allowing only specific, documented traffic flows. This aligns with commonly cited guidance such as the Purdue reference model for ICS network layering and ISA/IEC 62443 concepts for zones and conduits. NIST SP 800-82, Guide to Operational Technology Security, also emphasizes isolating OT from enterprise and untrusted networks, minimizing direct access to controllers, and using managed access methods for maintenance. Guest and BYOD devices are considered untrusted or less-trusted endpoints and should be kept separate from IoT and especially from SCADA, ICS, and OT systems.
- A. Correct.
Correct. Critical industrial assets such as SCADA servers and PLCs should be isolated in a dedicated OT/ICS segment or security zone. Access should be tightly controlled with ACLs or firewall policies that permit only necessary protocols, ports, and source systems, such as a managed jump host or historian. This follows common industrial network design guidance that emphasizes zoning and controlled conduits rather than flat network access.
- B. Incorrect.
Incorrect. Stronger wireless encryption helps protect the wireless link, but it does not provide the segmentation needed to prevent lateral movement. Placing guest and BYOD devices on the same subnet as IoT devices increases exposure and mixes untrusted endpoints with devices that often have limited security controls. Segmentation is about isolating trust zones, not just improving authentication.
- C. Correct.
Correct. Guest and BYOD traffic should be isolated into separate SSIDs and VLANs with policies that prevent direct communication to OT/ICS networks. This limits the blast radius of compromised personal or guest devices and is a standard way to enforce network segmentation for untrusted or less-managed endpoints while still allowing internet access or controlled access to approved business resources.
- D. Incorrect.
Incorrect. The guest network should not be used as a path to PLC management interfaces. Direct access from an untrusted network to industrial controllers bypasses segmentation controls and increases operational risk. If contractors require access, it should be through a controlled method such as VPN to a managed environment, a jump server, or a specifically approved maintenance zone with logging and restricted rules.
- E. Incorrect.
Incorrect. Badge readers and IP cameras are often treated as IoT devices and should not automatically be placed into the OT/ICS VLAN with PLCs and SCADA systems. Combining them into one broadcast domain increases risk and violates the principle of least privilege. Even if these devices support operations, they usually belong in separate segments with only narrowly defined communication paths to required services.