Air Gap Isolation for Externally Exposed Network Segments
Which of the following security controls is used to isolate a section of the network and its externally available resources from the internal corporate network in order to reduce the number of possible attacks?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
An air gap is the only listed control that removes network connectivity itself, so it is the correct answer when a scenario asks for isolation rather than filtering. Faraday cages, vaults, and proximity readers harden emissions, stored data, or physical entry but leave the network path intact.
The control that isolates an externally reachable network segment from the internal corporate network is an air gap, which physically prevents any network connection between the two sides. Because the exposed resources cannot reach the internal LAN at all, the number of possible attacks drops to whatever an adversary can do from the isolated segment alone.
Choosing Faraday cages because they sound like isolation. A Faraday cage blocks electromagnetic emanations and interference, not the Ethernet or Wi-Fi path an attacker would actually traverse to reach internal hosts.
Community Discussion (8 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
An air gap physically separates a network segment from every other network, so an externally reachable enclave can hold public-facing resources while having no route into the internal corporate network. Because the connection is removed rather than filtered, no packet from the exposed segment can initiate traffic toward internal systems, which is exactly why the number of possible attacks falls. CompTIA groups the air gap with physical security controls such as the screened subnet and secure areas, confirming that the mechanism is deliberate physical isolation rather than a software rule.Why the Other Options Are Wrong
Faraday cages shield equipment from electromagnetic interference and emanations, so they prevent signal leakage and some wireless attacks, but a caged host still communicates over its cabled network and reaches the corporate LAN. Vaulting refers to storing data, media, or credentials in a hardened location, and it protects information at rest without removing any network path between segments. Proximity readers are door-access devices that authenticate a person by the nearness of a token, so they govern who walks into a room rather than which network segments can reach one another. None of the three severs the network connection that the scenario asks to remove.Community Comment Notes
Most voters selected the air gap and described it as physically isolating a system that must not touch the internet, and ganymede called the whole option set weak and chose the least wrong. Elle drew the vaulting distinction directly, explaining that vaulting protects sensitive data in a protected location instead of isolating networks. psowrong added that air gaps can be physical or logical, while LayinCable tied the control to environments such as SCADA equipment that cannot be patched often.Official Reference
Exam Strategy
When an entire option set consists of physical or architectural controls, decide by what each control actually removes: connectivity, emanations, physical presence, or access to stored data. Air gap and screened subnet form the network-isolation pair, so anything that protects data at rest or authenticates people is a distractor in a network-isolation scenario.
Frequently Asked Questions
What is the difference between an air gap and a screened subnet for isolating exposed resources?
A screened subnet still routes traffic but filters it between zones, while an air gap removes the network path entirely, so no packet can pass between the isolated segment and the internal network.
Why is a Faraday cage not the answer when the goal is isolating a network segment?
A Faraday cage blocks electromagnetic emanations and interference, so it defends against signal leakage and some wireless attacks, but a caged server still uses its network interface and can reach the corporate LAN.