Question 740
A post-incident design review discusses the following: During a predeployment review for a hospital regional backbone, the team discovers this design gap: network operations want to collect telemetry from every site but will expose the collector publicly to simplify deployment. An approval gate requires both a measurable acceptance check and a durable prevention control. Which preventive design control MOST DIRECTLY addresses this specific risk?
Explanation
Correct Answer
Maintain collector certificates, ACL inventories and retention rules in the management standard. Apply the same control to the hospital regional backbone rollout checklist. This control targets the underlying design risk. Telemetry collectors can carry sensitive operational data and should be protected by management and access boundaries. The follow-up acceptance check remains: Only authorized sites and administrators can establish collector sessions and logs show approved sources. The hospital regional backbone acceptance record also captures this result.
Incorrect Answers
OOB management can remain accessible when an in-band production network or routing plane fails. The repeat risk here is different: Telemetry collectors can carry sensitive operational data and should be protected by management and access boundaries. A directly relevant preventive control is: Maintain collector certificates, ACL inventories and retention rules in the management standard. Apply the same control to the hospital regional backbone rollout checklist.
Management-plane segmentation reduces the attack surface and common-mode dependency on user traffic. The repeat risk here is different: Telemetry collectors can carry sensitive operational data and should be protected by management and access boundaries. A directly relevant preventive control is: Maintain collector certificates, ACL inventories and retention rules in the management standard. Apply the same control to the hospital regional backbone rollout checklist.
Shared management and infrastructure services become dependencies that can undermine an otherwise redundant routed network. The repeat risk here is different: Telemetry collectors can carry sensitive operational data and should be protected by management and access boundaries. A directly relevant preventive control is: Maintain collector certificates, ACL inventories and retention rules in the management standard. Apply the same control to the hospital regional backbone rollout checklist.