Elections tabulation systems sit on a high-sensitivity VLAN. Which firewall posture should automation enforce for that segment?
Select an answer to reveal the explanation.
Short Explanation
Default-deny is a locked ballot room: nothing gets in unless someone on the list opens the door. Elections tabulation VLANs need that posture—only explicitly approved flows. Guest Wi-Fi shortcuts into tabulation are exactly what you do not want.
Full Explanation
Elections tabulation systems on a high-sensitivity VLAN should run under a default-deny inbound firewall posture where only explicitly approved flows are allowed. Default-deny means unmatched traffic is dropped; administrators then allowlist specific management jump hosts, timing/source constraints, or tightly scoped application integrations. Automation should enforce that baseline continuously so temporary troubleshooting rules do not silently become permanent open paths into tabulation.
Permit-any from the public library Wi-Fi into the tabulation VLAN fails because library wireless is a broad, low-trust civic access network and has no legitimate need for unconstrained tabulation reachability. Opening all ports from city hall guest Wi-Fi for observer access fails similarly: observation requirements, if any, must be met with controlled, audited channels—not guest SSID any-any into elections. Mirroring production tabulation rules onto the guest conference SSID fails by copying sensitive allow patterns onto an inappropriate network identity and inviting policy confusion between production elections and visitor connectivity.
Exam caveat: default-deny is the inbound posture for the sensitive segment; it does not forbid carefully justified outbound or management paths, but those must be explicit. Elections environments may also require physical or logical air gaps—the firewall posture still follows allowlist discipline wherever connectivity exists.
Operational check: review the tabulation firewall and confirm the default action is deny; enumerate each allow rule against an approved flow register; attempt probes from library/guest networks and expect failure; and alert on any automation drift that inserts broad permits into the elections policy set.