SY0-701 Question 127
Single answerSegmentationA hospital is preparing for a security audit after a ransomware incident on its corporate user network. The security administrator discovers that nurse workstations, internet-facing kiosks, VoIP phones, HVAC controllers, and medical infusion pumps all share the same flat internal network. Leadership wants to reduce the chance that malware on a user workstation could laterally move to life-safety medical devices, while still allowing clinical systems to communicate where needed. Which action would BEST address this requirement?
- A
Implement network segmentation using separate VLANs and internal firewall/ACL rules between user devices, IoT/medical devices, and building systems
- B
Enable port security on all access switches so only approved MAC addresses can connect to the network
- C
Deploy a VPN for all nurse workstations so their traffic is encrypted before reaching medical devices
- D
Configure NAT on the edge firewall to hide internal IP addresses from the internet
Show answer and explanation
Correct answer: A
Explanation
The best answer is to implement segmentation with policy enforcement between segments. In a flat network, once malware compromises one endpoint, it can often scan and move laterally to any reachable system. Separating user workstations from medical devices and building systems into different VLANs or subnets, then restricting inter-segment traffic with internal firewalls or ACLs, directly reduces the attack surface and supports least privilege. This approach aligns with broadly accepted security architecture guidance, including zero trust principles and segmentation best practices for IoT/OT-style environments. For healthcare specifically, security guidance commonly emphasizes isolating medical devices from general-purpose IT networks because many embedded devices cannot support strong endpoint protections. Port security, VPNs, and NAT may each serve useful purposes, but they do not provide the same control over internal lateral movement as network segmentation with explicit traffic rules.
- A. Correct.
Correct. Segmenting the flat network into separate security zones, such as distinct VLANs or subnets for user endpoints, medical/IoT devices, and building management systems, is the most effective way to reduce lateral movement. Adding internal firewalls or ACLs between those segments enforces least privilege by allowing only required communications. This is a core application of segmentation and is commonly recommended for protecting operational technology, IoT, and medical environments from compromise spreading from general-purpose user networks.
- B. Incorrect.
Incorrect. Port security can help prevent unauthorized devices from connecting to switch ports, but it does not meaningfully control east-west traffic between already authorized devices on a flat network. It may reduce rogue device risk, but it does not solve the main problem in the scenario: limiting malware propagation and lateral movement between different classes of systems.
- C. Incorrect.
Incorrect. A VPN provides encrypted communication, typically across untrusted networks, but it does not segment internal systems by itself. If all devices remain on the same flat network, ransomware can still move laterally regardless of whether some traffic is encrypted. This option confuses confidentiality in transit with access control and segmentation.
- D. Incorrect.
Incorrect. NAT on the edge firewall can obscure internal addressing from external networks, but it does not control communications among internal hosts on the same network. The problem described is internal lateral movement after a workstation compromise, so edge NAT would have little impact on the stated requirement.