Network Segmentation and DMZs in IT/OT Systems

1. True or False: A screened subnet is another name for a demilitarized zone.

True

False

2. Which of the following best describes defense-in-depth for network segmentation?

Deploying a single powerful firewall

Using multiple layers of security controls across network boundaries

Blocking all external traffic permanently

Relying only on encryption for segment protection

3. True or False: In SecOT+ design, IT and OT networks should share the same physical infrastructure but logical segmentation is sufficient for security.

True

False

Submit

5. In DMZ architecture, what role do intrusion detection and prevention systems (IDS/IPS) play?

They replace the need for firewalls

They monitor traffic and block malicious patterns at segment boundaries

They encrypt all network communications

They provide user authentication only

6. What is the primary benefit of implementing micro-segmentation in OT networks?

It reduces the cost of network equipment

It isolates individual assets or workgroups to limit lateral movement

It eliminates the need for firewalls

It increases network speed automatically

7. True or False: Jump hosts or bastion hosts are used to provide secure administrative access across network segments.

True

False

Submit

9. Which of the following is a best practice for DMZ design in SecOT+ architecture?

Use a single firewall for all network protection

Implement dual firewalls and intrusion detection systems

Allow unrestricted communication between DMZ and internal networks

Disable logging to reduce administrative overhead

10. What is a key difference between network segmentation in IT versus OT environments?

OT systems prioritize availability and deterministic behavior over frequent patching

IT systems require real-time control like industrial processes

OT networks typically have higher bandwidth requirements

IT systems cannot tolerate any network latency

11. What is the primary purpose of a demilitarized zone (DMZ) in network architecture?

To isolate publicly accessible services from internal networks

To increase network bandwidth and speed

To eliminate the need for firewalls

To provide unlimited data storage

Submit

13. Which technology is commonly deployed at segment boundaries to enforce policies?

Load balancers

Network segmentation firewalls or next-gen firewalls

VPN concentrators

Proxy servers only

14. What access control model is most appropriate for SecOT+ network segmentation?

Allow all traffic by default, block only known threats

Deny all traffic by default, allow only necessary flows

Allow traffic based on time of day

Permit all internal traffic without restrictions

15. True or False: In converged IT/OT networks, OT systems should be placed in the same DMZ as web-facing IT services.

True

False

Submit

17. In a three-tier DMZ architecture, what is the role of the inner firewall?

It blocks all incoming internet traffic

It controls access between the DMZ and internal trusted networks

It monitors outbound traffic only

It encrypts all network communications

18. A DMZ typically contains which of the following systems?

Web servers, email gateways, and DNS servers

Critical production databases and file servers

User workstations and personal devices

Industrial controllers and safety PLCs

19. Which network segmentation model creates distinct zones based on trust levels and asset criticality?

Flat network topology

Zero Trust segmentation

Mesh network configuration

Ring topology design

20. In SecOT+ architecture, why is network segmentation critical for OT systems?

It reduces operational costs by consolidating equipment

It isolates safety-critical systems from IT threats and cyber attacks

It increases network bandwidth for industrial sensors

It eliminates the need for authentication protocols

SecOT+ IT OT Network Segmentation and DMZs Quiz

1. True or False: A screened subnet is another name for a demilitarized zone.

2.

What first name or nickname would you like us to use?

2. Which of the following best describes defense-in-depth for network segmentation?

3. True or False: In SecOT+ design, IT and OT networks should share the same physical infrastructure but logical segmentation is sufficient for security.

4. Network segmentation policies should be documented and reviewed ____.

5. In DMZ architecture, what role do intrusion detection and prevention systems (IDS/IPS) play?

6. What is the primary benefit of implementing micro-segmentation in OT networks?

7. True or False: Jump hosts or bastion hosts are used to provide secure administrative access across network segments.

8. A data diode enforces ____ communication between network segments.

9. Which of the following is a best practice for DMZ design in SecOT+ architecture?

10. What is a key difference between network segmentation in IT versus OT environments?

11. What is the primary purpose of a demilitarized zone (DMZ) in network architecture?

12. In Zero Trust architecture, every network access request must be ____.

13. Which technology is commonly deployed at segment boundaries to enforce policies?

14. What access control model is most appropriate for SecOT+ network segmentation?

15. True or False: In converged IT/OT networks, OT systems should be placed in the same DMZ as web-facing IT services.

16. Network segmentation reduces blast radius by ____.

17. In a three-tier DMZ architecture, what is the role of the inner firewall?

18. A DMZ typically contains which of the following systems?

19. Which network segmentation model creates distinct zones based on trust levels and asset criticality?

20. In SecOT+ architecture, why is network segmentation critical for OT systems?