SY0-701 Question 126
Single answerSegmentationA company is expanding its manufacturing network and has added several industrial control system (ICS) devices to monitor temperature and pressure on the factory floor. The security team is concerned that if a user workstation in the corporate network is compromised by ransomware, the malware could spread to the ICS environment and disrupt production. The company still needs engineers in the corporate network to access the ICS management server for authorized maintenance. Which solution BEST reduces this risk while preserving required access?
- A
Place the ICS devices and management server on a separate VLAN/subnet and enforce tightly limited traffic between the corporate network and the ICS segment with firewall ACLs
- B
Enable full-disk encryption on the engineer workstations so ransomware cannot reach the ICS environment
- C
Deploy load balancing in front of the ICS management server to improve availability during a malware outbreak
- D
Allow direct routing between the corporate and ICS networks, but require engineers to use stronger passwords for the management server
Show answer and explanation
Correct answer: A
Explanation
The best answer is to segment the ICS environment from the corporate network and permit only explicitly authorized traffic. In Security+ terms, segmentation is used to isolate sensitive or high-risk systems, reduce the blast radius of compromise, and control east-west traffic. This is especially important for operational technology and industrial control systems, where business impact from disruption can be severe. Best practices from sources such as NIST SP 800-82, Guide to Operational Technology Security, and NIST SP 800-41 on firewalls support separating ICS networks from enterprise networks and controlling communications through restrictive firewall policies or ACLs. The goal is not to eliminate necessary access, but to allow only the minimum required connectivity between segments.
- A. Correct.
Correct. Network segmentation is the best control in this scenario because it reduces the attack surface and limits lateral movement from compromised corporate endpoints into the operational technology environment. Placing ICS assets on a separate VLAN or subnet and restricting traffic with firewall rules or ACLs allows only necessary protocols and hosts, such as authorized engineer systems connecting to the ICS management server. This supports business needs while containing ransomware spread.
- B. Incorrect.
Incorrect. Full-disk encryption protects data at rest if a device is lost or stolen, but it does not prevent ransomware on an active workstation from attempting network-based lateral movement. Someone might choose this because encryption is an important security control, but it does not provide segmentation or isolate ICS resources from the corporate network.
- C. Incorrect.
Incorrect. Load balancing helps distribute traffic and can improve redundancy or performance, but it does not meaningfully segment the ICS environment or stop malware from moving between networks. This option addresses availability in a limited sense, not the core security requirement of isolating sensitive systems.
- D. Incorrect.
Incorrect. Stronger passwords improve authentication security, but they do not prevent unrestricted network connectivity or lateral movement. If direct routing remains open, a compromised workstation could still scan, exploit, or attempt to authenticate to ICS systems. This is a common misconception: stronger credentials alone are not a substitute for proper network segmentation.