Implement secure communication channels according to design for voice, multimedia collaboration, remote access, data communications, and virtualised networks.

A security manager is reviewing how third-party suppliers connect into the corporate network. Which control approach BEST reflects the secure communication channel principle of constraining third-party connectivity?

• AIssue each supplier a domain account, place them in a vendor group that is a member of the standard staff network, and rely on group policy to restrict their reachable destinations.
• BTerminate supplier connections in a dedicated extranet zone with explicit allow-list firewall rules to only the systems they support, time-bound credentials, and logging of every session for review.check_circle Correct
• CAllow suppliers to connect over the standard remote access VPN using their own laptops, and require the supplier to certify annually that the laptops meet the corporate security baseline.
• DPublish supplier-facing applications directly on the internet protected by a web application firewall, so that no inbound third-party tunnel into the corporate network is ever required.

Why A is wrong: Adding vendors to the staff network and relying on group policy creates broad implicit access and depends on host-side enforcement of network constraints, which is fragile. It is a defensible-but-second-best answer for environments that lack any segmentation, but it does not constrain the channel itself.

Why B is correct: An extranet zone with explicit allow-list rules, time-bound credentials, and session logging directly constrains the third-party channel to the minimum necessary access and supports detection and review. This matches the manager-led, least-privilege CISSP guidance for third-party connectivity.

Why C is wrong: Annual self-certification offers weak assurance, and using the standard VPN puts suppliers into the same trust zone as staff. Candidates may find this tempting because attestation sounds governance-aligned, but it does not constrain the channel or enforce posture at connection time.

Why D is wrong: Publishing applications can be appropriate for some workloads but is not a general answer for constraining third-party connectivity, and it ignores cases where suppliers need to reach internal systems. As a sole approach it leaves no structured channel control for supplier access.