Comprehensive and Detailed in-Depth
Problem Statement:
The organization needs tosecure legacy systemswhile maintaininginterconnectivitywith deployed assets.
Legacy systems are inherentlyvulnerableand canpose risksif directly connected to critical infrastructure.
Thegoalis to minimize risks withoutbreaking connectivity.
Why the Correct Answer is D (Screened Subnet):
Ascreened subnet(often called aDMZ - Demilitarized Zone) is anetwork segmentthat isolates potentially risky systems from theinternal network.
It is typically placedbetween two firewalls:
One firewall separates the DMZ from theexternal network (internet).
The other firewall isolates the DMZ from theinternal network.
This setup allowscontrolled communicationbetween legacy systems and internal assets while minimizing risk.
Key Benefits of a Screened Subnet:
Isolation:Separates legacy systems from the critical internal network.
Controlled Access:Usesfirewall rulesto restrictinbound and outbound traffic.
Reduced Attack Surface:Limits the potential impact of acompromised legacy system.
Interconnectivity Maintenance:Enables communication withdeployed assetswithout direct exposure.
Example Scenario:
A company haslegacy industrial control systems (ICS)that need to interact withmodern monitoring tools.
Placing the ICS within ascreened subnetensures:
Data flow is regulated.
Monitoring systems can still accessICS data without risking full network exposure.
Compromise of thelegacy systemdoes not automatically mean compromise of thecore network.
Why the Other Options Are Incorrect:
A . Software-defined networking (SDN):
SDN enablesdynamic network configuration, but it does not inherentlyisolate risky legacy systems.
While it can segment traffic, it is primarily used fornetwork flexibilityandmanagement, not isolation.
B . Containerization:
Containersisolate applications, but legacy systems often run ondedicated hardware or old OS environmentsthat are not container-compatible.
This approach does not meet the requirement of keeping thesystems interconnected.
C . Air gap:
Anair gapcompletelyisolates systems from any network.
This solutionbreaks interconnectivity, making itimpracticalfor the given requirement.
Ideal forhigh-security environmentsbut not whenintercommunicationis needed.
Real-World Example:
A healthcare organization haslegacy medical devicesthat must communicate with thepatient management system.
Placing these devices in ascreened subnetallows them to interact while beingisolatedfrom thecore hospital network, minimizingcyber risk.
Visual Representation:
less
CopyEdit
[Internet]
|
[Firewall 1]
|
[Screened Subnet/DMZ]
/ | \
[Legacy System 1] [Legacy System 2] [Monitoring Server]
|
[Firewall 2]
|
[Internal Network]
Thescreened subnetacts as abuffer zone, ensuringcontrolled communicationbetween the legacy systems and the internal network.
Extract from CompTIA SecurityX CAS-005 Study Guide:
TheCompTIA SecurityX CAS-005 Official Study Guideadvises using ascreened subnet (DMZ)when isolatinglegacy systemsthat still requirenetwork connectivity. The guide emphasizes that this approach significantlyreduces riskby minimizing theattack surfacewhile maintaining necessaryinter-system communication.

Reference:
OAuth and OpenID are two authentication protocols that can support the objectives of the organization. OAuth is a protocol that allows users to grant access to their resources on one site (or service) to another site (or service) without sharing their credentials. OpenID is a protocol that allows users to use an existing account to sign in to multiple websites without creating new passwords. Both protocols can support MFA, SaaS integration, risk-based policies, and just-in-time provisioning. Reference: https://auth0.com/docs/protocols/oauth2 https://openid.net/connect/

A machine-learning-based data security service would best meet the pharmaceutical company's requirements to discover data, monitor changes, and identify suspicious activity across thousands of independent resources in cloud object storage. Machine learning can analyze vast amounts of data, detect patterns, and alert administrators to anomalies or suspicious activities without manual intervention. Traditional file integrity monitoring or data classification might not scale well or adapt dynamically to the complexity and size of the company's environment. CASP+ highlights the use of advanced technologies like machine learning for cloud security and monitoring.
Reference:
CASP+ CAS-004 Exam Objectives: Domain 2.0 - Enterprise Security Operations (Machine Learning for Security) CompTIA CASP+ Study Guide: Cloud Security Monitoring with Machine Learning

OPC (Open Platform Communications) and Modbus are two common protocols used for industrial control systems (ICS). OPC is a standard that allows different devices and applications to exchange data in a vendor-neutral way. Modbus is a serial communication protocol that enables devices to send and receive commands and data over a network. Modbus has two variants: Modbus TCP/IP, which uses TCP port 502 for communication, and Modbus RTU/ASCII, which uses serial ports.
To allow an OPC server to communicate with a Modbus server that is controlling electrical relays, the security engineer should recommend restricting inbound traffic so that only the OPC server is permitted to reach the Modbus server on port 502. This configuration would:
Permit the OPC server to send commands and data to the Modbus server using Modbus TCP/IP protocol over port 502.
Limit operational disruptions, by preventing unauthorized or malicious access to the Modbus server from other sources.
Due to the limitations within the Modbus protocol, such as lack of encryption and authentication, restricting inbound traffic is a necessary security measure to protect the integrity and availability of the ICS.

Reference:
Homomorphic encryption is a type of encryption that allows computation and analysis of data within a ciphertext without knowledge of the plaintext. This means that encrypted data can be processed without being decrypted first, which enhances the security and privacy of the data. Homomorphic encryption can enable applications such as secure cloud computing, machine learning, and data analytics.Reference: https://www.ibm.com/security/homomorphic-encryption https://www.synopsys.com/blogs/software-security/homomorphic-encryption/