SY0-701 Question 92
Single answerLegacyA manufacturing company is connecting a 15-year-old HVAC control system to its corporate network so engineers can monitor building conditions remotely. The vendor states the system only supports Telnet for administration and cannot be upgraded without replacing the entire controller. Management wants remote access enabled quickly, but the security team is concerned about exposing a legacy system with weak security controls. Which of the following is the BEST way to reduce risk while still meeting the business requirement?
- A
Place the HVAC controller on a dedicated VLAN behind an internal firewall, restrict access to specific management hosts, and require administrators to connect through a VPN before reaching it
- B
Enable port forwarding on the internet firewall so engineers can connect directly to the HVAC controller over Telnet from home
- C
Allow the legacy controller on the main corporate user subnet, but enforce strong passwords on the device to compensate for the older protocol
- D
Install endpoint detection and response (EDR) software on the HVAC controller to monitor Telnet sessions and block malicious activity
Show answer and explanation
Correct answer: A
Explanation
Legacy systems are a common Security+ topic because they often cannot be patched, upgraded, or configured to use modern secure protocols. In these cases, the recommended approach is to apply compensating controls rather than expose the system broadly. Network segmentation, ACLs or firewall rules, jump hosts or approved management stations, and VPN-based remote access are standard methods for reducing the attack surface. Telnet should not be exposed directly because it is an insecure legacy protocol that lacks encryption. Guidance from organizations such as NIST, including principles from SP 800-41 on firewalls and SP 800-125/82 on segmentation and isolating specialized or operational technology environments, supports limiting communications paths and isolating legacy or insecure systems whenever replacement is not immediately possible.
- A. Correct.
This is correct because compensating controls are the appropriate way to protect legacy systems that cannot support modern security features. Segmenting the device on a dedicated VLAN or isolated network, filtering traffic with a firewall, limiting access to only authorized management hosts, and requiring VPN access significantly reduce exposure while still allowing remote administration. This aligns with Security+ best practices for handling legacy and unsupported systems through network isolation, access control, and secure remote access paths.
- B. Incorrect.
This is incorrect because exposing a Telnet service directly to the internet creates substantial risk. Telnet transmits credentials and session data in cleartext, making interception and unauthorized access much more likely. Although it provides quick remote access, it ignores basic security principles such as minimizing exposure and using encrypted management channels where possible.
- C. Incorrect.
This is incorrect because strong passwords do not solve Telnet's core weakness: lack of encryption. Placing the legacy device on the main corporate subnet also increases the blast radius if the system is compromised, potentially allowing lateral movement. A common misconception is that password strength alone can compensate for insecure protocols, but segmentation and restricted access are also necessary.
- D. Incorrect.
This is incorrect because most legacy embedded controllers do not support modern security agents such as EDR. Even if monitoring were possible, it would not eliminate Telnet's plaintext transmission risk. This option reflects a common but unrealistic assumption that all devices can run standard endpoint security tools.