Your organization must allow vendor remote access to an OT environment for maintenance windows. Which architecture best balances operational need with security?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because a jump server (bastion host) in an isolated vendor DMZ enforces single point of ingress, MFA reduces credential theft risk, session recording provides accountability, and time-limited access removes persistent exposure. A is wrong because permanent credentials with direct OT access violate least-privilege and remove the ability to revoke access instantly.
Full explanation below image
Full Explanation
B is correct because a jump server (bastion host) in an isolated vendor DMZ enforces single point of ingress, MFA reduces credential theft risk, session recording provides accountability, and time-limited access removes persistent exposure. A is wrong because permanent credentials with direct OT access violate least-privilege and remove the ability to revoke access instantly. C is wrong because direct RDP over the internet is highly exposed. D is wrong because a permanent site-to-site VPN extends trust to the vendor's entire network indefinitely.