Citizens use a city permitting portal on the public internet. Which control set is most appropriate to operate for that exposure?
Select an answer to reveal the explanation.
Short Explanation
A public permitting site sits on the sidewalk of the internet — you want layered doors, not an open lobby. Run NGFW, IDS/IPS, and a WAF-class control for the app. Badge printers and naked database ports do not stop HTTP exploits.
Full Explanation
Public permitting portals face continuous probing at the network and application layers. Appropriate protection typically combines next-generation firewalls for policy enforcement and threat intelligence at the perimeter, network IDS/IPS for known and anomalous traffic patterns, and web application firewall (or equivalent application-layer protections) suited to HTTP/S attacks such as injection, bot abuse, and common exploit kits targeting citizen-facing forms. Layering matches how attackers work: network controls alone miss many application payloads, while application controls without network visibility miss broader reconnaissance and lateral attempts. Tuning and logging across these controls support both prevention and investigation for municipal services that must stay available.
Disabling all perimeter inspection so traffic flows without friction maximizes exposure for a site designed for anonymous public use. Relying solely on a physical visitor badge printer for application-layer attacks confuses physical access control with HTTP exploit defense. Exposing the database listener directly on the internet without an application tier removes a critical trust boundary and invites direct data compromise. Exam caveat: defense in depth for web apps includes secure SDLC and patching—appliances do not replace code hygiene. Operationally, place the portal behind NGFW and WAF policies, alert on IDS signatures relevant to web attacks, and verify the database is reachable only from application tiers on private networks.