Air Gap Isolation for Externally Exposed Network Segments
Short answer
B An air gap physically isolates the externally available segment from the internal corporate network, removing the connection instead of filtering it.
Question
Key Takeaways
An air gap is the only listed control that removes network connectivity itself, so it is the correct answer when a scenario asks for isolation rather than filtering. Faraday cages, vaults, and proximity readers harden emissions, stored data, or physical entry but leave the network path intact.
The control that isolates an externally reachable network segment from the internal corporate network is an air gap, which physically prevents any network connection between the two sides. Because the exposed resources cannot reach the internal LAN at all, the number of possible attacks drops to whatever an adversary can do from the isolated segment alone.
Common mistake: Choosing Faraday cages because they sound like isolation. A Faraday cage blocks electromagnetic emanations and interference, not the Ethernet or Wi-Fi path an attacker would actually traverse to reach internal hosts.
Expert Analysis
Why the Answer Is Correct
An air gap physically separates a network segment from every other network, so an externally reachable enclave can hold public-facing resources while having no route into the internal corporate network. Because the connection is removed rather than filtered, no packet from the exposed segment can initiate traffic toward internal systems, which is exactly why the number of possible attacks falls. CompTIA groups the air gap with physical security controls such as the screened subnet and secure areas, confirming that the mechanism is deliberate physical isolation rather than a software rule.
Why the Other Options Are Wrong
Faraday cages shield equipment from electromagnetic interference and emanations, so they prevent signal leakage and some wireless attacks, but a caged host still communicates over its cabled network and reaches the corporate LAN. Vaulting refers to storing data, media, or credentials in a hardened location, and it protects information at rest without removing any network path between segments. Proximity readers are door-access devices that authenticate a person by the nearness of a token, so they govern who walks into a room rather than which network segments can reach one another. None of the three severs the network connection that the scenario asks to remove.
Community Comment Notes
Most voters selected the air gap and described it as physically isolating a system that must not touch the internet, and ganymede called the whole option set weak and chose the least wrong. Elle drew the vaulting distinction directly, explaining that vaulting protects sensitive data in a protected location instead of isolating networks. psowrong added that air gaps can be physical or logical, while LayinCable tied the control to environments such as SCADA equipment that cannot be patched often.
Official Reference
These links open the official vendor documentation in a new tab.
Exam Strategy
When an entire option set consists of physical or architectural controls, decide by what each control actually removes: connectivity, emanations, physical presence, or access to stored data. Air gap and screened subnet form the network-isolation pair, so anything that protects data at rest or authenticates people is a distractor in a network-isolation scenario.
Frequently Asked Questions
What is the difference between an air gap and a screened subnet for isolating exposed resources?
Why is a Faraday cage not the answer when the goal is isolating a network segment?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 8 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 8
-
rickirikci11 👍 3These new questions are just added. Anyone know why? are from 701 exam?
-
ganymede 👍 3 Answered BB. Air gap They are all wrong. But air gap is the least wrong.
-
LayinCable 👍 2 Answered BIt's B, they use Air Gapping to separate things that shouldn't be on a network or facing towards the inter-webz. Solely for security reasons since these machines/devices usually don't get updated often/new versions come out of the devices. So Air Gapping comes into play to literally isolate it and have it safe from any kind of attackers. Stuff like this would be SCADA factory equipment, camera systems, or even embedded systems sometimes too. To get to these, you most definitely have to be inside the building physically to get ahold of the equipment if you're not already a part of the company that has the Air Gapped "network." sorry for the long winded speech.
-
psowrong 👍 2 Answered AAir gap is a security measure that physically or logically isolates a computer, network, or system from unsecured networks, such as the internet or other parts of an internal network.
-
johnabayot 👍 2 Answered BI am comfortable with B as the answer
Show 3 more comments
-
Elle 👍 1 Answered BIt's air gap: is a security measure that physically isolates a computer or network from external networks, making it inaccessible via any network connection. Vaulting is a thing but used to securely storing sensitive data in a protected location, can be names cyber vault or just vault.
-
Hs1208 👍 1 Answered BAn air gap is a security measure that physically isolates a secure network or computer system from unsecured networks, such as the internet or less secure internal networks.
-
david124 👍 2 Answered BVaulting is not a thing lol
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.