Which of the following architecture models ensures that critical systems are physically isolated from the network to prevent access from users with…

The question asks for an architecture model that ensures critical systems are

physically isolated from the network to prevent remote access. The most precise

term for this is Air-gapped.

An air gap is a security measure where a secure computer network is physically

isolated from unsecured networks, such as the public internet or an unsecured local

area network. This means the computer or network has no network interface controllers

connected to other networks, creating a physical separation (NIST Glossary;

arXiv:2409.04190v1). This directly addresses the requirement of physical isolation to

prevent remote access.

A. Segmentation: Network segmentation involves dividing a network into smaller,

isolated subnetworks or zones, often using firewalls or VLANs. While it enhances

security by limiting the spread of attacks, it is typically a logical separation, not

necessarily complete physical isolation from all external connectivity (Otifyd.com -

Network Segmentation; Armis - Network Segmentation).

B. Virtualized: Virtualization abstracts computing resources from physical constraints,

allowing multiple virtual machines to run on single physical hardware. While virtual

machines can be isolated from each other, virtualization itself doesn't ensure physical

isolation of the entire system from external networks. In fact, virtualized environments

can introduce new complexities to maintaining isolation if not configured properly

(Canadian Centre for Cyber Security - ITSP.70.010; PCI Security Standards Council -

Virtualization InfoSupp).

D. Serverless: Serverless architecture is a cloud computing execution model where the

cloud provider manages the server infrastructure, and application code is run in stateless

compute containers. This model is about how applications are deployed and run, not

about the physical network isolation of critical systems from remote access

(ResearchGate - Security of Zero Trust Networks in Cloud Computing).

National Institute of Standards and Technology (NIST). "air gap - Glossary". NIST

Computer Security Resource Center (CSRC). Accessed June 2, 2025.

https://csrc.nist.gov/glossary/term/air_gap (Definition of air gap).

Ganesan, S., et al. (2024). "Mind The Gap: Can Air-Gaps Keep Your Private Data

Secure?". arXiv:2409.04190v1 [cs.CR]. Accessed June 2, 2025.

https://arxiv.org/html/2409.04190v1 (Section 1, "Introduction" discusses physical and

logical isolation of air-gapped networks).

Otifyd. "Network Segmentation | OTIFYD - Safeguarding OT Networks". Accessed

June 2, 2025. https://otifyd.com/services/network-segmentation/ (Describes network

segmentation as an architectural approach that divides a network, can be physical or

virtual, but not necessarily an air gap).

Armis. "Chapter 7 – Network Segmentation: A Cybersecurity Best Practice to Protect

Industrial Assets". Armis Blog. Accessed June 2, 2025.

https://www.armis.com/blog/chapter-7-network-segmentation-a-cybersecurity-bestpractice-to-protect-industrial-assets/ (Explains network segmentation and mentions air

gap as a form of segmentation but distinct).

Canadian Centre for Cyber Security. "Cyber Centre data centre virtualization report:

Best practices for data centre virtualization (ITSP.70.010)". Canadian Centre for Cyber

Security Publications. March 2020. Accessed June 2, 2025.

https://www.cyber.gc.ca/en/guidance/cyber-centre-data-centre-virtualization-report- best-

practices-data-centre-virtualization (Page 1, "Overview" discusses that replacing

physical isolation with logical equivalents in virtualization can introduce risk).

PCI Security Standards Council. "Information Supplement: PCI DSS Virtualization

Guidelines v2.0". PCI Security Standards Council Document Library. October 2011.

Accessed June 2, 2025.

https://www.pcisecuritystandards.org/documents/Virtualization_InfoSupp_v2.pdf (Page

6, Section 2.1 discusses virtualization concepts and does not imply inherent physical

network isolation).

Bhatt, S., et al. (2022). "Security of Zero Trust Networks in Cloud Computing: A

Comparative Review". ResearchGate. September 2022. Accessed June 2, 2025.

https://www.researchgate.net/publication/363386313_Security_of_Zero_Trust_Netwo

rks_in_Cloud_Computing_A_Comparative_Review (Describes cloud architectures, not

specifically physical isolation in the context of air gaps).