An organization has several production-critical SCADA supervisory systems that cannot follow the normal 30- day patching policy. Which of the following BEST maximizes the protection of these systems…

A firewall with deep packet inspection (DPI) goes beyond simple port/protocol filtering by inspecting the actual content of packets for malware, exploits, and protocol anomalies. For unpatched SCADA systems, DPI acts as a virtual patching mechanism, identifying and blocking malicious traffic before it reaches the vulnerable system. This provides the strongest compensating control because it actively analyzes and blocks malicious software delivery attempts regardless of port or protocol.

Placing systems in a separate zone and restricting access to known ports is a basic network segmentation control that limits the attack surface but does not inspect traffic content for malware, leaving the systems vulnerable to attacks delivered over those permitted ports.

Application whitelisting (allowing only necessary applications to run) is a host-based control that prevents unauthorized software execution but does not directly protect against malicious software being delivered and potentially exploiting the allowed applications on an unpatched system.

Configuring the host firewall to restrict listening ports reduces exposure but only controls inbound connection points; it does not inspect the content of permitted traffic for malicious payloads and provides weaker protection than a network-level DPI firewall.