A hospital control says a records workload must stay off the public internet to meet the ISO control they adopted, and the workload already runs in the approved cloud environment. Which connectivity recommendation fits?
Select an answer to reveal the explanation.
Short Explanation
A longer lock on a public sidewalk still leaves the records on the sidewalk. The control they adopted says this workload stays off the public internet, and the environment is already the approved one, so you recommend a private path into it. Treat this as a design fit, not a legal opinion.
Full Explanation
The workload is already in the approved environment. The remaining constraint is the path: the records must not cross the public internet because that is the ISO-based control the hospital adopted. Private connectivity into that environment keeps the path off the internet. Internet IPsec lands in the same environment, but the packets still traverse the public internet. A longer IKE lifetime only changes rekey timing. Direct internet access from the clinics optimizes delay and puts the records flow on the public internet on purpose, which contradicts the control. An award given to the campus firewall vendor is marketing. It does not change the underlay, and it is not evidence that a public path satisfies a control that forbids the public internet. Exam caveat: a private circuit does not certify the hospital against ISO. It only satisfies the path constraint they stated. The management system and the cloud environment are separate decisions. Operational check: the route for the records prefix should use the private interconnect, and a packet capture on the internet edge should not show that prefix.