SY0-701 Question 254
Select 2A manufacturing company is connecting a legacy ICS/SCADA segment to a new analytics platform hosted in the cloud. The plant floor includes PLCs and HMIs that run continuously and cannot tolerate frequent reboots or intrusive scans. Security staff are concerned about malware spreading from the corporate network into the control environment and about unauthorized remote changes to controller logic. Which of the following actions would BEST harden this environment while preserving operational stability? (Choose two.)
- A
Place the ICS network in a dedicated segmented zone and tightly restrict traffic between the corporate network, cloud environment, and control systems using allow-list rules
- B
Deploy aggressive vulnerability scans and routine credentialed patch cycles directly against PLCs and HMIs during production hours
- C
Require remote vendors and administrators to use a jump server with MFA before accessing engineering workstations or management interfaces
- D
Enable direct internet access from PLCs so they can download firmware updates from vendor sites as needed
- E
Install full-featured endpoint protection with automatic remediation agents on all embedded controllers and PLCs
Show answer and explanation
Correct answers: A, C
Explanation
The best answers are to segment the ICS/SCADA environment and to control remote administrative access through a jump server with MFA. In operational technology environments, security hardening must be balanced with safety, availability, and deterministic performance. Unlike standard enterprise servers or workstations, PLCs, HMIs, embedded systems, and RTOS-based devices may be sensitive to intrusive scanning, frequent patching, or unsupported security agents. Best practices commonly recommend zoning and segmentation, least privilege, tightly controlled remote access, and change management. This approach is consistent with widely used guidance such as NIST SP 800-82, Guide to Operational Technology (OT) Security, and ISA/IEC 62443 concepts for zones, conduits, and restricted access.
- A. Correct.
Correct. Network segmentation is a core hardening control for ICS/SCADA environments. Placing control systems in a dedicated zone and allowing only explicitly required traffic reduces the attack surface and helps prevent malware or unauthorized commands from moving laterally from corporate or cloud-connected networks into the operational technology environment. This approach aligns with common ICS guidance to use conduits, zones, and least functionality.
- B. Incorrect.
Incorrect. Traditional aggressive scanning and routine patching practices that are common on enterprise workstations or servers can disrupt fragile or legacy ICS assets. PLCs and HMIs often require vendor validation, maintenance windows, and careful testing before updates. Running intrusive scans during production hours can cause instability or outages, which is a major misconception when applying IT hardening methods directly to OT systems.
- C. Correct.
Correct. Requiring remote access through a controlled jump server with MFA reduces the risk of unauthorized remote changes and provides a central point for monitoring and access control. This is a practical hardening step for environments where vendors or engineers need remote access but direct access to engineering workstations or controller management interfaces should be restricted.
- D. Incorrect.
Incorrect. PLCs should not have direct internet access. Allowing controllers to reach vendor sites increases exposure and bypasses normal inspection and change-control processes. Firmware updates should typically be obtained through controlled administrative processes, validated, and deployed during approved maintenance windows rather than downloaded directly from the internet by control devices.
- E. Incorrect.
Incorrect. Many PLCs and embedded controllers do not support traditional endpoint protection agents, and installing them can affect device reliability or vendor support status. A common mistake is treating embedded or real-time control devices like standard workstations. Compensating controls such as segmentation, application-specific allow-listing where supported, jump hosts, and strict access control are generally more appropriate.