N10-009 Question 260
Select 2A manufacturing company is modernizing its network. The plant floor contains SCADA servers, PLCs, and other OT/ICS devices that control production lines. The company also recently added IP cameras and environmental sensors, allows employees to connect personal phones to Wi-Fi, and provides guest wireless access for vendors. Management is concerned that non-production devices could reach critical control systems. Which TWO actions best enforce proper network segmentation while still allowing required business access?
- A
Place SCADA and other OT/ICS devices on dedicated VLANs or separate subnets behind internal firewalls/ACLs, and permit only explicitly required traffic from approved management systems
- B
Connect IoT cameras, BYOD clients, and guest wireless users to the same production VLAN so monitoring tools can more easily discover all devices
- C
Use separate SSIDs and network segments for guest and BYOD access, and block direct access from those segments to OT/ICS networks
- D
Disable encryption on OT segments so industrial protocols can be inspected more easily by any troubleshooting device
- E
Assign all devices to one large subnet and rely on endpoint antivirus to stop unauthorized access to PLCs and SCADA servers
Show answer and explanation
Correct answers: A, C
Explanation
The best answers are to isolate OT/ICS assets in dedicated network segments protected by ACLs or internal firewalls, and to place guest and BYOD users on separate SSIDs/VLANs with no direct path to production networks. In industrial environments, segmentation is a primary method for reducing risk because many PLCs, HMIs, SCADA components, and other OT systems are sensitive, difficult to patch, or support limited security controls. Network+ expects candidates to understand practical trust-boundary design: critical operational systems should be separated from enterprise IT, IoT, guest, and BYOD networks, with only explicitly required traffic allowed.
These practices align with widely recognized guidance such as NIST SP 800-82, Guide to Operational Technology (OT) Security, which recommends isolating OT networks and strictly controlling communications between OT and other networks. They also align with ISA/IEC 62443 concepts of zones and conduits, where systems of similar trust levels are grouped together and inter-zone communications are tightly managed. For general enterprise networking, guest and BYOD segmentation through separate VLANs/SSIDs with firewall enforcement is a common best practice to prevent unauthorized access and limit lateral movement.
- A. Correct.
This is correct. Critical SCADA, ICS, and OT systems should be isolated from less-trusted networks using dedicated VLANs or separate routed segments with restrictive ACLs or internal firewalls. A default-deny approach that permits only required traffic from approved jump hosts, engineering workstations, historians, or management servers is a standard segmentation practice for industrial environments. This reduces the blast radius of compromise and limits lateral movement from IoT, BYOD, or guest networks into production control systems.
- B. Incorrect.
This is incorrect. Putting IoT, BYOD, guest, and production OT devices on the same VLAN defeats segmentation and increases risk. Discovery convenience is not a valid reason to mix trust zones. Cameras and sensors may have weaker security controls, while guest and BYOD devices are inherently less trusted. Combining them with PLCs and SCADA assets would expose critical systems to unnecessary attack paths.
- C. Correct.
This is correct. Guest and BYOD should be treated as separate, less-trusted network segments. Using distinct SSIDs mapped to separate VLANs or subnets and enforcing policies that prevent direct communication to OT/ICS networks is a common and effective control. If business access is needed, it should occur through controlled services such as a VPN, jump server, proxy, or tightly filtered firewall rules rather than unrestricted east-west connectivity.
- D. Incorrect.
This is incorrect. Disabling encryption is not a segmentation control and would weaken security. Also, not all OT troubleshooting requires making traffic visible to any device on the network. Inspection, where needed, should be performed through approved security tools, SPAN ports, taps, or authorized monitoring architectures. Reducing confidentiality to make analysis easier creates unnecessary risk.
- E. Incorrect.
This is incorrect. A flat network is contrary to segmentation best practices, especially in environments with SCADA and ICS assets. Endpoint antivirus alone is insufficient because many OT devices cannot run standard endpoint protection, and antivirus does not replace network isolation or traffic filtering. Relying on a single control ignores defense-in-depth and leaves critical systems exposed to lateral movement.