How Should a Hospital Secure Vendor Remote Access to HVAC?
A hospital's requirements for remote third-party monitoring of the HVAC system include the following: • The vendor must be able to continuously monitor system health and respond accordingly. • The vendor must only have network access to the HVAC system. • The vendor must be the only entity with access to the HVAC system. Which of the following best meets the hospital's requirements?
Community Insight
This question tests least-privilege third-party access to an OT/HVAC system; the trap is treating an outbound-only appliance as scoped access even though it sits directly on the internal network.
The hospital needs continuous vendor monitoring and response while limiting the vendor's network reach to only the HVAC system. This page establishes that a restricted site-to-site VPN (C) best meets those least-privilege and exclusive-access requirements.
The common wrong choice is B, the vendor-managed appliance with outbound SSL, because it sounds like zero inbound exposure while ignoring that the appliance can reach other internal systems and is not explicitly restricted to the HVAC system.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A restricted site-to-site VPN (C) is the only option that combines a dedicated encrypted path with explicit reachability limits to the HVAC system. The tunnel supports continuous bidirectional monitoring and vendor responses, which a one-way data feed may not. Firewall or ACL restrictions on the tunnel enforce the requirement that the vendor can reach only the HVAC system, while vendor-only credentials keep other parties out of that remote path. This is the standard least-privilege pattern for third-party OT access.Why the Other Options Are Wrong
An RDP jump box (A) is interactive rather than continuous monitoring and typically gives the vendor a foothold on a broader internal network, violating the 'only HVAC' requirement. The vendor appliance with outbound SSL (B) sounds safe, but placing a vendor-managed device on the internal network gives it potential reach to other hospital systems unless it is separately segmented, and the option never states that restriction. A reverse web proxy (D) exposes the HVAC system to internet-originated access and cannot guarantee that the vendor is the only entity with access; it also broadens the attack surface. None of these options explicitly scopes the vendor's access to the HVAC system the way the restricted VPN does.Community Comment Notes
BWH9492 favored option B as an OT/ICS pattern for "zero inbound exposure" using an on-premises appliance with outbound-only SSL/TLS. That is a legitimate technique for reducing inbound firewall holes, but it does not by itself satisfy the hospital's 'only HVAC' and 'vendor only' requirements unless the appliance is tightly segmented and dedicated. The comment is useful as a reminder to avoid inbound exposure, but the explicit restriction in C is what makes it the better fit for this scenario.Official Reference
Exam Strategy
When a scenario repeats 'only' and 'restricted,' choose the option that explicitly enforces scope, not one that merely avoids inbound ports. Ask whether the proposed device or tunnel is actually limited to the named system, and whether it supports the required two-way response.
Frequently Asked Questions
Why is the vendor appliance with outbound SSL (B) not the best fit?
It puts a vendor-managed appliance on the internal network, where it may reach more than the HVAC system; outbound-only traffic does not by itself enforce least privilege.
Does a site-to-site VPN meet the 'vendor-only' access requirement?
Yes, when the tunnel and firewall rules are dedicated to the vendor and scope reachability to the HVAC system only, with credentials held only by the vendor.