SY0-701 Question 163
Single answerPhysical isolation: Air-gappedA defense contractor maintains a workstation used to process highly sensitive design files. The system is intentionally air-gapped from all corporate and external networks. Engineers occasionally need to move approved CAD files onto the workstation. During a security review, an auditor notes that staff are using personally owned USB drives to transfer files after scanning them on an internet-connected laptop. Which action would BEST preserve the security objective of the air gap while still supporting the business need?
- A
Allow file transfers to continue as long as the personal USB drives are scanned with up-to-date antivirus software before use
- B
Connect the air-gapped workstation to a separate VLAN with a firewall so files can be transferred securely without using removable media
- C
Implement a controlled media transfer process using organization-issued removable media that is scanned, logged, and handled through a dedicated transfer station
- D
Install endpoint detection and response software on the air-gapped workstation so any malware introduced by USB devices can be identified and removed quickly
Show answer and explanation
Correct answer: C
Explanation
The best answer is to implement a controlled media transfer process using organization-issued removable media and a dedicated transfer station. The purpose of an air gap is physical isolation from other networks to reduce exposure to remote compromise. Once users begin connecting the system to any network, even a segmented one, the air gap is lost. Because business operations may still require limited file movement, best practice is to use tightly controlled removable media procedures, including approved media, malware scanning, access control, logging, and documented handling processes. This aligns with common guidance from NIST publications on media protection, system isolation, and controlled information transfer, such as NIST SP 800-53 controls related to MP (Media Protection) and SC (System and Communications Protection). In practice, compensating controls around removable media are essential because threats such as infected USB devices have historically bypassed isolated environments when transfer procedures were weak.
- A. Incorrect.
This is incorrect. Antivirus scanning on an internet-connected laptop reduces some risk but does not preserve the security intent of an air-gapped system. Personally owned media introduces uncontrolled supply-chain and contamination risk, and scanning alone does not guarantee detection of malicious files, firmware-based threats, or policy violations. A common misconception is that malware scanning by itself makes removable media safe for high-security environments.
- B. Incorrect.
This is incorrect. Placing the system on a VLAN, even with a firewall, breaks true physical isolation. A VLAN is a logical segmentation control, not an air gap. Firewalls are useful for network security, but they do not provide the same assurance as a physically isolated system. This option reflects the common misunderstanding that strong network segmentation is equivalent to physical isolation.
- C. Correct.
This is correct. A controlled media transfer process is the best fit for an air-gapped environment that still requires occasional data movement. Using organization-issued media, a dedicated transfer station, malware scanning, logging, chain-of-custody, and approval procedures preserves the air gap while reducing the risk of introducing malicious code or unauthorized files. This is a practical compensating control commonly used in high-security environments where complete elimination of data transfer is not feasible.
- D. Incorrect.
This is incorrect. EDR can improve detection on endpoints, but it does not preserve the security objective of the air gap and should not be treated as the primary control for introducing removable media into a highly sensitive isolated system. In many air-gapped environments, updating and centrally managing EDR tools may also be operationally difficult. The main issue here is preventing contamination through controlled transfer procedures, not relying on post-infection detection.