How would you support Tanium in an air-gapped or highly segmented network?

How would you support Tanium in an air-gapped or highly segmented network?

• A. Deploy local relays; ensure updated content via secure transport; use offline patches or a controlled update channel; maintain governance.
• B. Open all ports to allow automatic updates.
• C. Disable all content updates permanently.
• D. Use consumer-grade USB drives without encryption.

Answer: (A)

In air-gapped or highly segmented networks, you must keep the update flow contained, secure, and auditable while still delivering the necessary content to endpoints. Deploying local relays inside the network lets Tanium content move efficiently where needed without exposing systems to the internet. Coupling that with updates delivered through a secure transport from a trusted, controlled channel ensures authenticity and integrity of every payload. When connectivity to the internet isn’t available, using offline patches or a defined, controlled update process allows you to import vetted content without breaking the isolation. Maintaining governance provides the change-control, approvals, and version tracking that let you verify what was deployed, when, and by whom, and to roll back if necessary. This approach preserves isolation, reduces risk, and keeps the update lifecycle manageable in a restricted environment. Opening all ports to automatic updates defeats the purpose of an air gap and increases exposure. Disabling content updates permanently leaves systems unpatched and vulnerable. Using consumer-grade USB drives without encryption introduces integrity and confidentiality risks in transfer and storage.

In air-gapped or highly segmented networks, you must keep the update flow contained, secure, and auditable while still delivering the necessary content to endpoints. Deploying local relays inside the network lets Tanium content move efficiently where needed without exposing systems to the internet. Coupling that with updates delivered through a secure transport from a trusted, controlled channel ensures authenticity and integrity of every payload. When connectivity to the internet isn’t available, using offline patches or a defined, controlled update process allows you to import vetted content without breaking the isolation. Maintaining governance provides the change-control, approvals, and version tracking that let you verify what was deployed, when, and by whom, and to roll back if necessary. This approach preserves isolation, reduces risk, and keeps the update lifecycle manageable in a restricted environment.

Opening all ports to automatic updates defeats the purpose of an air gap and increases exposure. Disabling content updates permanently leaves systems unpatched and vulnerable. Using consumer-grade USB drives without encryption introduces integrity and confidentiality risks in transfer and storage.