A research lab keeps its classified design network physically disconnected from all other networks, with no wired or wireless links. Malware is nevertheless found on several workstations in that network, and the investigation traces it to a USB drive a contractor used to move test files into the lab. What does this incident BEST demonstrate about air-gapped networks?

An air-gapped network has no physical or wireless connection to other networks, which blocks remote network-based attacks. Data still has to enter and leave somehow, and removable media such as USB drives become the bridge. Malware carried in on a drive, whether by a malicious insider or an unwitting contractor, bypasses the gap entirely, as several well-known attacks on isolated industrial networks have shown. Effective air gaps therefore rely on strict media controls: approved and scanned devices, dedicated transfer stations, and restrictions on who may bring media in. Attributing the failure to enabled wireless adapters contradicts the scenario, which states there were no wireless links. Saying an air gap protects only against physical intrusion inverts its purpose; it is designed to prevent network-based attacks, and physical controls are a separate layer. Blaming an internet firewall misconfiguration is inconsistent with a network that has no internet connection, so there is no firewall path to misconfigure. Exam caveat: air gaps reduce the attack surface substantially but create a false sense of security when media handling and insider risk are not addressed. Operational check: enforce a media transfer procedure through a dedicated scanning kiosk, disable USB storage on the isolated workstations except through approved devices, log every transfer, and review contractor access to the lab.