CompTIA Security+ (SY0-701)Security ArchitectureMedium
A defense contractor stores highly classified research data on a network with no physical or wireless connection to the internet or any other network. Data must be manually transferred using approved removable media after being scanned for malware. Which architecture does this describe?
- AVirtual private cloud
- BSoftware-defined perimeter
- CScreened subnet
- DAir-gapped network
Show answer & explanationAnswer & explanation
Correct answer: D. Air-gapped network
An air-gapped network is physically isolated from other networks, including the internet, with no direct connectivity; data transfer requires manual methods like removable media, which matches the scenario.
Why the other options are wrong
- A. A virtual private cloud is a logically isolated but still network-connected cloud environment.
- B. A software-defined perimeter dynamically controls network access but still involves network connectivity.
- C. A screened subnet (DMZ) is still connected to the internet with filtering, not fully isolated.
Air-Gapped Network
A network physically isolated from other networks and the internet, requiring manual/offline methods to transfer data.
- Used for highly classified or critical control systems
- Eliminates remote network-based attack vectors
- Data moved via approved removable media
Memory trick: No wires, no waves, no way in.