A manufacturing floor uses barcode scanners and a kiosk terminal that cannot support full endpoint agents or frequent manual patching. USB storage has previously introduced malware, and the devices only need to run one approved application and reach a backend system. Which two controls best reduce risk while preserving function? Select two.

Place the devices on the user VLAN so patching and support tools can reach them easily.

Putting constrained devices on the user VLAN increases exposure to unrelated systems and makes lateral movement easier. Convenience for support does not justify broader trust when the devices have known limitations. A separate segment with narrow access rules is more appropriate for production-floor endpoints.

Allow USB storage so updates can be installed manually whenever needed.

Allowing removable media reintroduces the exact infection path described in the scenario. Even if updates are sometimes needed, unrestricted USB use is not a safe default. A controlled update process or signed package workflow is better than permitting arbitrary removable devices.

Use local administrator accounts with shared passwords to reduce support calls.

Shared local administrator passwords weaken accountability, make credential theft more damaging, and violate least privilege principles. They also create a persistence path for malware or insiders. Support efficiency is not a valid reason to sacrifice identity traceability and privilege control on production devices.

What does this SY0-701 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Isolate the scanners and kiosk terminal on a dedicated VLAN that allows only the required backend ports. — The safest solution for constrained manufacturing devices is to reduce both network exposure and execution freedom. A dedicated VLAN with only required backend ports limits what the devices can reach, and kiosk mode or application allowlisting ensures they can only run the approved software. Together, these controls compensate for the devices' inability to support full endpoint security stacks. Why others are wrong: The user VLAN exposes the devices to unnecessary traffic and potential lateral movement. USB storage is a direct malware path and should not be allowed as a convenience measure. Shared local administrator passwords create weak accountability and can be abused for persistence or privilege escalation. None of those choices reduce risk while preserving function as well as segmentation plus allowlisting.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.