Incident responders trace lateral movement from a compromised lobby printer into the CAD network. Which network-security approach best limits that path going forward?
Select an answer to reveal the explanation.
Short Explanation
A hacked printer should be a dead end, not a subway to CAD. Micro-segmentation and zero-trust style rules stop east-west hops that flat networks happily allow.
Full Explanation
Lateral movement from a compromised lobby printer into CAD shows flat internal trust. Micro-segmentation with distributed enforcement limits east-west paths so printer VLANs cannot reach CAD unless explicit policy allows narrowly defined flows—aligning with zero-trust networking ideas that authorize by identity and need, not by “inside the building.” Distributed firewalls or host/network policy engines shrink blast radius from low-trust peripherals into critical design systems.
Granting printers domain-admin rights for driver convenience turns every print device into a privilege goldmine. Removing internal firewalls for a single edge ACL restores the failure mode just observed. Placing CAD shares on open printer SMB paths invites theft and ransomware staging from the lobby outward.
Exam caveat: CISSP expects micro-segmentation and zero-trust-aligned east-west control as responses to lateral movement—not flatter networks or privileged IoT-like devices.
Operational check: inventory printer-to-CAD paths; implement deny-by-default policies between printer and CAD segments; allow only print spooler or approved gateways; monitor blocked flows; patch and isolate printers; remove unnecessary domain privileges; retest with assumed printer compromise scenarios.