I85PREP
⌘ K
PCN PEP study materials
PCN PEP study resources

PCN PEP: Network Architecture and Segmentation

PCN PEP · Work through your exam, one topic at a time.

All guide sections

Network Architecture and Segmentation

Domain 3 tests zone and conduit design, DMZ placement, firewall rule construction, VLAN limitations, and control of data flows between IT and OT.

Core rules

  • IEC 62443 zones group assets with common security requirements; conduits control communication between zones.
  • The IT/OT DMZ at Level 3.5 terminates enterprise sessions and brokers historian replication, patch staging, and remote access.
  • Firewalls should permit only required protocols, sources, destinations, and directions. Default deny is the baseline; stateful inspection suits TCP, while UDP needs tighter rules.
  • VLANs segment broadcast domains but are not a security boundary without ACLs or a firewall.
  • Unidirectional gateways or data diodes are appropriate for egress-only telemetry and where no return path is needed.

Worked example

An enterprise user needs historian data. Do not allow direct SQL from Level 4 to the Level 3 historian. Place a replica historian in the DMZ; the Level 3 historian pushes to the DMZ replica; Level 4 reads only the DMZ replica. Reasoning: this breaks the direct enterprise-to-control path, limits exposure, and still delivers data. The rules are specific to host and port, not any-any.

Traps

Treating a VLAN as a firewall; allowing any-any from IT to OT for management; forgetting the reverse direction needed for updates; over-blocking safety or time-sync traffic; placing the DMZ inside the control zone.