mediumMultiple ChoiceObjective-mapped
SSCP Network Segmentation Practice Question
A hospital's IT department manages a network with hundreds of medical devices, including patient monitors and infusion pumps, all connected to a separate VLAN. The security team has identified that several devices are running outdated firmware with known vulnerabilities. The vendor has not released patches for these legacy devices. The hospital cannot replace them immediately due to budget constraints. The network team proposes moving the devices to a more restrictive firewall zone and implementing intrusion detection. Which of the following additional controls should be implemented to BEST reduce the risk of a breach exploiting these devices?
⚠ Common exam trap
Candidates may confuse compensating controls like IDS/IPS with effective segmentation. For unpatched legacy devices, preventing access is key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement strict network segmentation and access control lists (ACLs) to allow only necessary traffic
The best additional control is strict network segmentation and ACLs (option D) to limit communication to only essential traffic, reducing the attack surface despite the unpatched devices. Daily vulnerability scans (A) only identify issues without remediation. Host-based IPS (B) is often unsupported on legacy medical devices. A WAF (C) protects web applications, not the device-specific protocols used by monitors and pumps. Since the devices are already on a separate VLAN, further restricting allowed traffic with ACLs minimizes exposure to exploits and prevents lateral movement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conduct daily vulnerability scans on the device VLAN
Why it's wrong here
Scanning identifies but does not mitigate the vulnerability; it may also cause instability.
- ✗
Deploy host-based intrusion prevention on each device
Why it's wrong here
Medical devices often cannot support additional software, and it may interfere with operation.
- ✗
Use a web application firewall (WAF) in front of the devices
Why it's wrong here
WAFs are for HTTP traffic; medical devices often use proprietary protocols.
- ✓
Implement strict network segmentation and access control lists (ACLs) to allow only necessary traffic
Why this is correct
Segmentation with ACLs minimizes exposure and is feasible without modifying the devices.
Visual reference
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.