Certified Ethical Hacker (CEH) Practice Question

Moving the vulnerable controllers to their own VLAN and limiting inbound traffic to only the known management hosts applies network segmentation and access-control principles that directly reduce an attacker's ability to reach the devices. This compensating control contains exposure without interrupting legitimate use. Simply blocking port 80 at the perimeter does not protect the devices from internal threat actors or compromised hosts on the same LAN. Installing traditional antivirus is usually impossible on embedded IoT hardware and, even if feasible, would not address the root cause-unrestricted network access. MAC address filtering on Wi-Fi is easily spoofed and would not mitigate attacks that originate from other wired segments or through compromised devices already on the list.