County public health runs open-weight models on GPU servers that share an unsegmented VLAN with unrelated clinic systems. What infrastructure change best reduces lateral risk?
Select an answer to reveal the explanation.
Short Explanation
Those GPUs are like a locked lab sitting in the middle of the open hallway. Put GenAI inference on its own network segment so a noisy neighbor cannot stroll sideways. More admin rights, dead firewalls, and parking PHI in VRAM make the blast radius worse.
Full Explanation
County public-health GenAI inference on GPU servers that share an unsegmented VLAN with unrelated clinic systems creates a flat trust domain: compromise of a clinic host or of the GenAI tier can move laterally with few network barriers. The best infrastructure change is moving inference hosts onto a segmented network zone dedicated to GenAI workloads, with controlled east-west paths, tighter security groups or firewall rules, and clear trust boundaries between clinic systems and model-serving hosts that may process sensitive municipal health content.
Giving every clinic workstation admin rights to the GPU boxes widens privilege and blast radius rather than reducing lateral risk. Turning off host firewalls to speed discovery removes a host-level control that segmentation is meant to complement. Storing clinic PHI in GPU VRAM overnight for convenience treats volatile accelerator memory as a data store and increases residual-data exposure if processes crash, nodes are reused, or memory is improperly cleared.
Exam caveat: segmentation does not replace identity, encryption, or patching; it limits how far a foothold travels inside civic infrastructure. Operational check: confirm inference nodes sit on a dedicated VLAN or subnet, review allowlists between clinic and GenAI zones, and verify that management jump paths are explicit rather than flat L2 adjacency across health and GenAI systems.