Municipal permitting and payment workloads are moving into a virtual private cloud. Planners need subnetting, gateways, and isolation that match sensitivity. Which VPC design principle is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
A VPC isn’t automatically safe just because it’s 'in the cloud'—it’s a neighborhood you still have to zone. Keep public entry points small, tuck sensitive payment stuff in private space, and don’t give every app a freeway to every other app.
Full Explanation
A municipal VPC is still a network you must zone. Permitting apps and payment workloads differ in sensitivity, so design should place Internet-facing components in controlled public subnets while keeping application and data tiers in private subnets reachable only through approved gateways and load balancers. Restricting east-west paths between tiers limits lateral movement after a web-tier compromise. Isolating payment components from general permitting applications reduces PCI-aligned blast radius and keeps cardholder or treasury functions from sharing a flat trust domain with lower-sensitivity workflow apps. Controlled gateways—not a single shared Internet door—are the architectural expression of least privilege in the cloud.
One large subnet with a single Internet gateway simplifies routing diagrams while maximizing blast radius and making every workload adjacent to every other. Exposing payment APIs on public subnets without a web tier minimizes latency by maximizing direct attack surface on sensitive interfaces. Peering every VPC to every other city VPC with full transitive routing recreates a flat enterprise WAN in the cloud and defeats the isolation VPC boundaries were meant to provide.
Exam caveat: CISSP cloud and network design items reward subnet tiering, controlled ingress/egress, and separation by sensitivity. Shared subnets, transitive peering by default, and public placement of payment APIs are classic wrong answers dressed as simplicity or performance.
Operational check: map permitting versus payment workloads to separate subnets or accounts where policy requires; confirm security groups and NACLs deny unexpected east-west paths; ensure payment tiers have no direct Internet route; review VPC peering for least-privilege routes only; and test that a compromised public web instance cannot reach payment data stores without traversing mediated controls.