Applying QoS at the access switch based on source IP (or other identifiers like DSCP) allows for granular prioritization of specific critical traffic flows. This is more scalable and manageable than a separate physical network (Option A) and more precise than prioritizing an entire VLAN (Option C), which could include non-critical traffic. While Cyber Vision (Option D) provides visibility and security policy, its primary function is not dynamic bandwidth management in the way dedicated QoS mechanisms are.

Simple protocol converters (often called “serial-to-Ethernet adapters”) frequently lack basic security functions like authentication, encryption, or access control. They effectively create an unprotected pathway, allowing threats from the IT network to potentially propagate directly into the sensitive OT layer. This is a fundamental architectural risk. While monitoring (Option B) might be harder, the primary concern is the security breach, not observability.

The “fire door” analogy perfectly captures the primary security benefit of segmentation: containment. If a breach or malicious activity occurs in one segment (e.g., the guest Wi-Fi), segmentation controls (like ACLs or firewall policies) act as a barrier to prevent it from easily spreading to more critical segments (e.g., building management systems). This limits the “blast radius” of an attack.

Intermittent connectivity, especially localized to devices likely connected via wireless gateways, strongly points to RF interference. Common sources in retail environments include newly installed wireless equipment, cordless phones, or even microwave ovens. This step is non-disruptive and logical before moving to hardware replacement (Option A) or widespread firmware changes (Option C). IP addressing (Option D) typically causes a complete loss of connectivity, not an intermittent one.

For mobile IoT assets using untrusted public networks (cellular), a VPN provides essential encryption for data in transit. Combining this with device certificates (machine authentication) ensures that only authorized vehicles can establish the VPN tunnel, providing a strong security posture. MAC filtering (Option A) is easily spoofed and irrelevant over cellular. NAT (Option C) and STP (Option D) are core networking functions but do not address the core security need for mobile connectivity.

Microsegmentation is the practice of creating fine-grained, policy-driven segments, often at the workload or device level. It allows the network to enforce strict access controls between specific devices or groups (like isolating medication dispensers from the general clinical Wi-Fi segment), which aligns perfectly with this security mandate. Zero-Trust (Option B) is a broader model that includes microsegmentation as a key component. QoS (Option A) manages traffic priority, not access.

SNMP is a lightweight, widely adopted protocol specifically designed for monitoring and managing network devices and IoT endpoints. Its get/set/trap operations are ideal for polling status (on/off) and sending simple commands efficiently at scale. While NETCONF/YANG (Option A) and RESTCONF (Option D) are powerful for configuration management, they are generally heavier than SNMP for simple state monitoring. SSH/CLI (Option C) does not scale to thousands of devices.

A key value of fog/edge computing is reducing latency and bandwidth usage. A fog node at an intersection can analyze raw video feed locally to detect incidents or count cars, then send only the metadata (e.g., “accident detected at Main & 5th”) to the central cloud. This is far more efficient than streaming all raw footage (Option A). It is not primarily for public Wi-Fi (Option B) nor a direct replacement for core networking gear (Option D).

Specialized IoT management platforms are designed for the heterogeneity of IoT. They often include protocol translators for legacy OT protocols (Modbus, BACnet) and use deep packet inspection or other methods to automatically profile devices—discovering vendor, type, and firmware version—which is critical for vulnerability management. Standard enterprise tools typically lack this depth of OT/IoT visibility. Cost (Option A) is not guaranteed, and it does not replace core infrastructure (Option D).

Applying QoS at the access switch based on source IP (or other identifiers like DSCP) allows for granular prioritization of specific critical traffic flows. This is more scalable and manageable than a separate physical network (Option A) and more precise than prioritizing an entire VLAN (Option C), which could include non-critical traffic. While Cyber Vision (Option D) provides visibility and security policy, its primary function is not dynamic bandwidth management in the way dedicated QoS mechanisms are.0