Which option is the primary purpose of the demilitarized zone in a converged industrial network?

Question

Options

• ASeparate the manufacturing zone from the enterprise zone.
• BDemarcate the entry point to the cell/area zone.
• CProvide isolation of industrial devices from monitors.
• DReduce external attacks on the industrial network.

• A
  88% (52)
• B
  7% (4)
• C
  2% (1)
• D
  3% (2)

Explanation

In a converged industrial network (where OT/industrial systems connect with enterprise IT), the DMZ acts as a buffer zone between the manufacturing (OT) zone and the enterprise (IT) zone, allowing controlled data exchange without direct connectivity between the two - this is option A. Without a DMZ, a compromise on the enterprise side could directly reach industrial control systems (ICS/SCADA), with potentially catastrophic physical consequences.

Why the distractors are wrong:

• B is incorrect because the DMZ sits between zones at a higher level, not at the entry to a cell/area zone (that's handled by zone-level firewalls or conduits per IEC 62443).
• C is incorrect because industrial device isolation from monitors is an internal zone concern, not the DMZ's role.
• D is partially true (a DMZ does reduce attack surface), but reducing external attacks is a secondary benefit - the primary architectural purpose is separating the two functional zones.

Memory tip: Think of the DMZ like an airport customs hall - it's the controlled space between the outside world (enterprise) and the secure area (manufacturing), not a wall against outsiders, but a managed handoff point between two distinct zones.

No community discussion yet for this question.