In a manufacturing company, the systems that control production lines sit on the same flat network as office workstations used for email and web browsing. What is the PRIMARY benefit of separating them into distinct network segments?
Select an answer to reveal the explanation.
Short Explanation
Think of watertight compartments on a ship: a breach in one doesn't sink the whole vessel. Email and web browsing are where most infections start, so you don't want them sharing a room with the production line. The trap is treating segmentation as a replacement for other duties.
Full Explanation
Segmentation divides a network into zones with controlled pathways between them, so that a compromise in one zone cannot freely reach another. Office workstations are routinely exposed to phishing, malicious downloads and web threats; on a flat network, malware on one of them can reach production control systems directly and disrupt operations. Placing production systems in their own zone with tightly restricted, monitored connections contains that blast radius and protects the business process with the highest operational impact. Segmentation does not remove the need to patch production systems; it reduces exposure while patching is constrained, but vulnerabilities remain and must still be managed through a risk-based program. Bandwidth for office users may change as a side effect of network redesign, but it is not a security objective and would not justify the effort. Responsibility for security does not move to plant engineers because of a network change; accountability for the risk stays with the business owner, while operational duties are assigned through governance. Exam caveat: CISM frames segmentation by its business purpose, containing impact on critical processes, rather than by technical implementation detail. Operational check: map every permitted connection between the office and production zones, confirm each has a business justification and owner, and verify that unlisted traffic is blocked.