SY0-701 Question 199
Single answerInfrastructure considerations: Device placement , Security zones , Attack surface , Connectivity , Failure modes (Fail-open , Fail-closed )A hospital is redesigning its network to support internet-facing patient appointment portals, internal electronic health record (EHR) systems, and life-safety medical devices that must remain reachable during a security appliance failure. The security architect wants to minimize the attack surface, properly separate security zones, and choose failure behavior that best fits each system's risk. Which design choice BEST meets these requirements?
- A
Place the patient portal and EHR systems on the same internal VLAN behind a single firewall, and configure all inspection points to fail-open so availability is preserved.
- B
Place the patient portal in a screened subnet/DMZ, keep the EHR systems in an internal protected zone, isolate life-safety medical devices in a dedicated security zone, and configure the medical device connectivity path to fail-open while keeping the portal and EHR inspection paths fail-closed.
- C
Place life-safety medical devices directly on the internet edge to reduce latency, keep the patient portal in the internal network, and configure the perimeter firewall to fail-closed for all traffic.
- D
Use one flat network for all systems, but reduce attack surface by disabling unused switch ports and requiring VPN access for administrators only.
Show answer and explanation
Correct answer: B
Explanation
The best answer is the one that aligns device placement, segmentation, attack surface reduction, connectivity needs, and failure modes with business and safety requirements. Security best practices commonly recommend placing internet-facing services in a DMZ or screened subnet, while keeping sensitive internal resources in protected internal segments. Network segmentation and security zoning are also widely recommended by standards and guidance such as NIST SP 800-41 for firewalls and NIST SP 800-125/800-207 concepts around segmentation and trust boundaries. For healthcare and operationally critical environments, separate zones for medical or safety-related devices reduce attack surface and contain incidents. Failure mode decisions depend on mission impact: fail-closed favors security by blocking traffic when a control fails, while fail-open favors availability by allowing traffic to continue. In real environments, life-safety systems may justify fail-open behavior for specific paths when loss of connectivity could create patient safety risk, whereas systems processing sensitive data, such as portals and EHRs, typically favor fail-closed to avoid uninspected or unauthorized access during a control failure.
- A. Incorrect.
Incorrect. Putting the patient portal and EHR systems on the same internal VLAN weakens security zone separation and increases the blast radius if the internet-facing portal is compromised. A public-facing application should typically be placed in a DMZ or screened subnet rather than alongside sensitive internal systems. Configuring all inspection points to fail-open also creates unnecessary risk for systems handling sensitive healthcare data because security controls would be bypassed during failure.
- B. Correct.
Correct. This design applies several core infrastructure security principles appropriately. The internet-facing patient portal belongs in a DMZ/screened subnet to limit exposure of internal assets. EHR systems should remain in a protected internal zone because they contain sensitive data. Life-safety medical devices should be isolated in their own zone to reduce attack surface and limit lateral movement. Choosing fail-open for life-safety device connectivity can be appropriate when availability is the top priority and interruption could endanger patients, while fail-closed is more appropriate for the portal and EHR inspection paths because preserving confidentiality and integrity is critical for those systems.
- C. Incorrect.
Incorrect. Placing life-safety medical devices directly on the internet edge dramatically expands attack surface and violates basic segmentation and least exposure principles. Lower latency does not justify exposing critical devices to untrusted networks. Keeping the patient portal inside the internal network also reverses recommended placement; internet-facing systems should be separated from internal assets. Although fail-closed can be appropriate for many perimeter controls, the overall design is flawed due to poor device placement and zone separation.
- D. Incorrect.
Incorrect. Disabling unused switch ports is a good hardening step, but it does not compensate for using a flat network for internet-facing applications, sensitive records systems, and medical devices. A flat network increases attack surface and facilitates lateral movement after compromise. Restricting administrator access with VPN helps administrative security, but it does not solve the main issues of device placement, security zoning, and choosing different failure modes based on system criticality.