Election-results uploads currently depend on a single perimeter firewall between the upload server and the internet. What architecture change best reduces single-control dependence?
Select an answer to reveal the explanation.
Short Explanation
One firewall is a single drawbridge. Defense in depth stacks gates—segment the path, prove who is uploading, lock down what can run, and watch the logs—so one failed gate doesn’t dump the election results onto the street.
Full Explanation
Depending on a single perimeter firewall for election-results uploads creates a brittle architecture: misconfiguration, zero-day bypass, credentialed insider misuse past the firewall, or simple outage of that one device can expose or interrupt a high-integrity civic process. Defense in depth reduces single-control dependence by layering complementary controls around the upload path—network segmentation isolating the upload tier, strong authentication for uploaders, application allowlisting on the server, TLS and integrity checks on payloads, and continuous monitoring/alerting on anomalous transfers. Removing the firewall because election night is “busy” eliminates a control without replacement. Increasing the firewall’s throughput rating alone still leaves one choke-point control class; capacity is not diversity. Publishing the upload server on a public file share expands the attack surface and invites tampering under the guise of transparency. Exam caveat: CISSP emphasizes overlapping controls of different types (preventive, detective, technical, administrative) so failure of one does not equal mission failure—especially for election and critical civic systems. Operational check: map the upload data flow, place the server in a restricted segment with deny-by-default ingress, require MFA and role-limited upload credentials, enforce allowlisted upload binaries/services, and validate SIEM use cases fire on failed auth, unexpected destinations, and off-schedule bulk transfers during tabletop and rehearsal nights.