A city 311 stack must keep the application tier from talking freely to the database tier. Which workload configuration should automation enforce?
Select an answer to reveal the explanation.
Short Explanation
Picture the 311 app and DB like two locked rooms with a single keyed door between them—not a hallway with every door open. Automation should keep that ACL or security group narrow so only the app tier hits the database ports. Wide-open east-west access is how a small breach becomes a big one.
Full Explanation
Multi-tier municipal applications such as a city 311 stack depend on enforced separation between the application tier and the database tier. Automation should install and continuously reconcile network ACLs or cloud security-group rules that allow only the application-tier identities or subnets to reach the specific database listener ports required for normal operation. That posture implements least privilege at the network layer: even if an application host is compromised, east-west reach is limited to what the service truly needs, and opportunistic scanning of the data tier from unrelated workloads is blocked by default.
Opening all east-west ports between the application and database subnets fails on concept because troubleshooting convenience is not a security control. Wide-open lateral paths convert a single app-tier foothold into free database-network access and defeat the purpose of tiered design. Granting the database tier inbound access from the entire civic Wi-Fi guest network fails because guest wireless is an untrusted citizen-facing segment; permitting it to database ports collapses zoning between public connectivity and authoritative municipal data. Disabling ACLs and relying on application passwords alone fails because authentication is not a substitute for network segmentation—stolen or weak credentials, mis-scoped service accounts, or application bugs can still speak to the database if the network path is unrestricted.
Exam caveat: security groups and ACLs are complementary to, not replacements for, database authentication, encryption in transit, and least-privilege database roles. The question asks specifically which workload network configuration automation should enforce for tier separation, so the network allowlist is the correct focus.
Operational check: after automation applies the rules, verify from an application host that the database port succeeds, verify from a non-app host on another tier or guest segment that the same port is denied, and confirm change tickets or IaC diffs show only the intended app-to-DB allowances rather than broad permit-any east-west entries.