A network architect is designing a new branch office. The branch hosts a public-facing web application, an internal HR portal, and manufacturing control systems (OT). Which segmentation model best reduces lateral movement risk if any one segment is compromised?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — separate security zones with enforced inter-zone ACLs limit blast radius, so if the public web app is compromised, you don't automatically get access to HR or OT. A flat network or co-locating OT with other systems just widens the attack path.
Full Explanation
Three separate VLANs (DMZ, internal, OT) with stateful firewall ACLs between each zone and no direct OT-to-internet routing limits blast radius: compromising the DMZ does not automatically grant access to HR or OT. A flat VLAN with host-based firewalls is wrong because a flat network allows unrestricted lateral movement once any host is compromised. A single DMZ with HR and OT together is wrong because co-locating HR and OT creates unnecessary risk to critical infrastructure. Direct OT internet exposure is wrong because it violates fundamental ICS security principles.