SY0-701 Question 164
Single answerPhysical isolation: Air-gappedA defense contractor maintains an engineering workstation that stores classified design data. The workstation is intentionally air-gapped from all corporate and external networks. Engineers occasionally need to transfer approved design files to a separate system for release review. Security leadership is concerned about malware entering or leaving the air-gapped environment during these transfers. Which control would BEST preserve the security benefits of the air gap while still allowing the business process to continue?
- A
Use a dedicated, tightly controlled transfer process with approved removable media that is scanned on a separate validation system before and after use
- B
Temporarily connect the workstation to an isolated VLAN during file transfers so endpoint protection can inspect the files in real time
- C
Allow engineers to use personal encrypted USB drives because encryption prevents malware from executing during transfer
- D
Enable Bluetooth file transfer between the air-gapped workstation and the review system to avoid using removable media
Show answer and explanation
Correct answer: A
Explanation
Air-gapped systems rely on physical isolation rather than logical segmentation. The main security challenge is controlled data transfer without creating a direct electronic path to other networks or systems. In practice, organizations use approved removable media, documented handling procedures, malware scanning on intermediary validation systems, and strict authorization for imports and exports. This aligns with common guidance from NIST on media protection and system isolation principles, such as controlling access to media, sanitizing media, and reducing opportunities for malware introduction during cross-domain or offline transfer processes. The key distinction is that an air gap is defeated by temporary network connectivity, VLAN membership, or wireless links such as Bluetooth. Therefore, the best answer is the dedicated removable-media transfer process with separate validation and strict procedural controls.
- A. Correct.
Correct. An air-gapped system should remain physically isolated from other networks, so file movement typically must occur through strictly managed removable media procedures. Best practice is to use organization-owned media only, enforce chain-of-custody and authorization, and scan the media on a separate trusted system before introducing it into the air-gapped environment and again after data is exported. This reduces the risk of introducing malware and helps preserve the purpose of the air gap while still supporting an operational transfer process.
- B. Incorrect.
Incorrect. Connecting the workstation to any network, even temporarily or to an isolated VLAN, breaks the air gap. A VLAN is a logical separation, not physical isolation. This option reflects a common misconception that segmented networks provide the same protection as an air-gapped environment. They do not; once connected, the host is no longer air-gapped.
- C. Incorrect.
Incorrect. Encryption protects confidentiality of data at rest or in transit, but it does not inherently prevent malware from being stored on or transferred by the USB drive. Personal media also weakens control over provenance, handling, and sanitization. This is a common misunderstanding: encrypted media can still carry malicious files.
- D. Incorrect.
Incorrect. Bluetooth is a wireless communication channel. Enabling it would directly undermine physical isolation and introduce an additional attack surface. Avoiding removable media does not make this safer, because the core requirement of an air gap is to prevent direct network or wireless connectivity to other systems.