After a phishing wave hits enterprise IT, leadership wants to reduce the chance that malware can reach water-plant SCADA. Which mitigation best limits that blast radius?

Network segmentation separates high-impact OT/SCADA environments from general enterprise IT so phishing or malware in office email does not freely reach water-plant controls. Controlled, monitored boundaries—firewalls, data diodes where appropriate, jump hosts, and tightly scoped conduits—limit blast radius after an enterprise compromise. For municipal water utilities, that separation is both a security control and a public-safety expectation.

Publishing the SCADA historian on the public internet for easier vendor support massively expands attack surface and invites opportunistic scanning; convenience does not justify exposing plant data and potential control pathways. Merging SCADA and corporate VLANs to simplify troubleshooting removes the very boundary that contains enterprise malware, increasing coupling when leadership asked to reduce blast radius. Disabling all logging on OT gateways to improve throughput destroys visibility needed to detect crossover abuse and hampers incident response.

Exam caveat: segmentation is the primary architectural mitigation when stems ask how to keep enterprise malware from reaching SCADA; patching and awareness help but do not replace zone separation. “Air gap” absolutism is rare in modern plants—exam language favors segmented, monitored connections over reckless flat networks.

Operational check: inventory conduits between IT and OT, enforce deny-by-default firewall policies, require MFA jump access for vendors, monitor allowed flows for anomalies, and exercise tabletop scenarios where a phishing-led IT breach tries to pivot toward the water plant.