SY0-701 Question 173
Single answerIoTA hospital is deploying internet-connected infusion pumps so biomedical staff can remotely monitor device status and receive maintenance alerts. The pumps do not need to communicate directly with user workstations or the internet, but they must send telemetry to a vendor-supported management server. The security team is concerned that if one pump is compromised, it could be used to move laterally into other parts of the network. Which of the following is the BEST way to reduce this risk while preserving required functionality?
- A
Place the infusion pumps on a dedicated VLAN or microsegmented network and allow only required traffic to the management server
- B
Disable logging on the infusion pumps to reduce exposed metadata and improve device performance
- C
Install host-based antivirus software on each infusion pump and allow unrestricted outbound access for signature updates
- D
Connect the infusion pumps to the same network as nurse workstations so staff can troubleshoot them more easily
Show answer and explanation
Correct answer: A
Explanation
The best answer is to isolate the IoT medical devices on a dedicated network segment and tightly restrict communications to only what is necessary. This aligns with common security best practices for IoT and healthcare environments: use network segmentation, least privilege, allowlisting, and monitoring to compensate for the limited security capabilities of many embedded devices. Guidance from organizations such as NIST emphasizes isolating IoT devices, limiting unnecessary services and communications, and using network-based controls when device-level controls are limited. In practical terms, a dedicated VLAN, ACLs, firewall rules, or microsegmentation policies can prevent a compromised infusion pump from reaching workstations, servers, or other clinical systems while still allowing telemetry to the approved management server.
- A. Correct.
Correct. Network segmentation is a primary security control for IoT and medical devices because many such devices have limited built-in security features and may not support traditional endpoint protection. Placing the infusion pumps on a dedicated VLAN or using microsegmentation limits east-west traffic and reduces the blast radius if one device is compromised. Allowing only the specific protocols, ports, and destinations required for the pumps to reach the management server preserves functionality while minimizing lateral movement risk.
- B. Incorrect.
Incorrect. Disabling logging reduces visibility and makes it harder to detect compromise, malfunction, or policy violations. For IoT and medical devices, centralized logging and monitoring are important compensating controls because endpoint-based security tools are often limited or unsupported. Reducing logs does not meaningfully prevent lateral movement.
- C. Incorrect.
Incorrect. Many IoT and embedded medical devices do not support host-based antivirus, and attempting to force unsupported security software onto them can create stability and compliance issues. In addition, allowing unrestricted outbound access weakens network security and increases exposure. The question asks for the BEST way to reduce lateral movement while maintaining required communications, which is better addressed through segmentation and strict access control.
- D. Incorrect.
Incorrect. Placing the pumps on the same network as user workstations increases the attack surface and makes lateral movement easier, not harder. Although shared access may seem convenient for troubleshooting, convenience should not override the need to isolate critical IoT and operational devices from general-purpose endpoints.