A failover WAN link for the courthouse activates during outages but intentionally bypasses the primary firewall and IDS to 'guarantee connectivity.' Which principle should redesign follow?
Select an answer to reveal the explanation.
Short Explanation
Failover that skips the firewall is a secret tunnel that only opens on your worst day—or whenever someone forces it. Redundancy should keep the same security seatbelt on, not rip it off to go faster.
Full Explanation
A courthouse failover WAN that intentionally bypasses the primary firewall and IDS guarantees connectivity by creating an unfiltered path into the network precisely when operations are stressed—or whenever someone forces the failover. Secure redesign requires redundant and failover paths to enforce equivalent security controls: same inspection, same policy intent, same logging expectations. Availability must not be purchased by opening a secret tunnel that malware and external attackers can also use. Resilience and filtering are complementary requirements, not opposites.
Keeping the bypass permanently enabled so failovers never need testing normalizes the insecure path and removes incentive to validate secure redundancy. Preferring cellular failover with no logging because outages are rare combines an alternate path with deliberate blindness. Removing all redundancy so a single filtered path always wins abandons availability; the correct lesson is equivalent controls on every path, not elimination of failover.
Exam caveat: CISSP architecture principles include fail-secure and consistent policy across primary and backup paths. Bypass-for-availability is a classic anti-pattern on exams and in breaches.
Operational check: trace failover routing and confirm traffic still hits firewall/IDS or equivalent cloud inspection; enable logging on backup links; test failover under change control; and remove permanent physical or logical bypass jumpers that skip security stacks.