Cisco CCNP Security Core (SCOR) 350-701Visibility and EnforcementHard
A security architect is designing a network for a critical infrastructure facility. The design requires absolute segregation of the operational technology (OT) network from the information technology (IT) network, allowing only unidirectional data flow from OT to IT for monitoring purposes. No data should ever be able to flow from IT back to OT. Which technology is paramount for enforcing this strict unidirectional data flow?
- ANext-Generation Firewall (NGFW)
- BData Diode
- CIntrusion Prevention System (IPS)
- DVirtual Local Area Network (VLAN)
Show answer & explanationAnswer & explanation
Correct answer: B. Data Diode
A data diode is a hardware-enforced device that physically ensures unidirectional data flow. Unlike firewalls or IPS, which rely on software rules that could potentially be misconfigured or bypassed, a data diode's design makes it physically impossible for data to flow in the reverse direction, directly addressing the requirement for 'absolute segregation' and 'no data should ever be able to flow from IT back to OT'.
Why the other options are wrong
- A. An NGFW can enforce strong rules, but it is a software-based solution that, theoretically, could be misconfigured or compromised to allow bidirectional flow. It doesn't offer the absolute physical guarantee of a data diode.
- C. An IPS is for threat detection and prevention, not for enforcing strict unidirectional data flow. It operates on traffic that is already permitted to pass.
- D. VLANs provide logical segmentation, but they do not enforce unidirectional data flow. Traffic between VLANs is typically routed by a Layer 3 device, which can be configured for bidirectional flow.
Data Diode
A hardware-based network security device that creates an electronically or optically enforced unidirectional data flow between two networks, preventing any data from flowing in the reverse direction.
- Provides absolute physical segregation.
- Commonly used in critical infrastructure (OT/ICS) and high-security environments.
- Eliminates the possibility of reverse data flow or cyberattacks across the boundary.
Memory trick: Critical infrastructure needs a one-way street for data, no U-turns allowed.