SY0-701 Question 174
Single answerIoTA healthcare clinic is deploying internet-connected infusion pumps and patient monitoring devices on its network. During a security review, the administrator discovers the devices use vendor-supplied default credentials, cannot run traditional endpoint protection, and frequently communicate with cloud-based management services. The clinic wants to reduce the risk that a compromised IoT device could be used to access electronic health record systems while still allowing the devices to function normally. Which of the following is the BEST solution?
- A
Place the IoT devices on a dedicated VLAN with restrictive ACLs that allow only required communication to management systems and approved cloud endpoints
- B
Install host-based antivirus software on each IoT device and configure weekly full-disk scans
- C
Disable logging for the IoT devices to reduce the chance of exposing protected health information in log files
- D
Connect the IoT devices to the same network as workstations so clinicians can access them more easily without firewall restrictions
Show answer and explanation
Correct answer: A
Explanation
The best answer is to segment the IoT devices onto a dedicated network and tightly control permitted communications. IoT devices, including medical devices, often have limited built-in security capabilities, may use embedded operating systems, and may not support host-based security agents. Because of these constraints, Security+ expects candidates to recognize compensating controls such as network segmentation, ACLs, firewalling, and continuous monitoring. This reduces the attack surface and limits lateral movement if one device is compromised. The approach aligns with least privilege and with widely accepted guidance from NIST on IoT and device cybersecurity, including recommendations in NISTIR 8259 and network isolation concepts commonly used for embedded and operational technology environments. In healthcare environments, this is especially important to protect adjacent systems that handle electronic health records and other regulated data.
- A. Correct.
Correct. Network segmentation is one of the most effective compensating controls for IoT devices, especially when they cannot support traditional endpoint security tools. Placing the devices on a dedicated VLAN and applying restrictive ACLs or firewall rules limits east-west movement and reduces the chance that a compromised infusion pump or monitor could reach sensitive systems such as EHR servers. Allowing only necessary traffic to management platforms and specific cloud services follows least privilege and is a common best practice for medical and other embedded devices.
- B. Incorrect.
Incorrect. Many IoT and embedded medical devices do not support standard host-based antivirus or full-disk scans due to limited operating system access, vendor restrictions, or performance concerns. This option reflects a common misconception that all endpoints can be secured the same way as desktops and laptops. In practice, compensating controls such as segmentation, access control, and monitoring are more realistic.
- C. Incorrect.
Incorrect. Disabling logging reduces visibility and impairs incident detection and investigation. While organizations must handle logs carefully to protect sensitive data, the correct approach is to minimize logged PHI where possible and secure log storage and access, not to turn logging off. For IoT security, maintaining audit records is important for identifying abnormal communications or compromise.
- D. Incorrect.
Incorrect. Placing IoT devices on the same flat network as user workstations increases risk by making lateral movement easier for an attacker. Convenience does not outweigh the security impact in this scenario. A core principle for IoT deployments is isolating less-manageable or less-trusted devices from critical business systems.