To reduce exposure, management proposes moving every production database service from its default port to a nonstandard port and treating that change as the main network protection for the databases. How should the DBA characterize this proposal?
Select an answer to reveal the explanation.
Short Explanation
Moving your database to a weird port is like taking the house number off your front door: casual passers-by won't knock, but anyone who walks the street still finds the house. It's fine as a bit of noise reduction, just never mistake it for a lock. The trap is any answer that lets you drop real controls because the port is 'hidden'.
Full Explanation
Changing a database service from its default port is security through obscurity. It can reduce opportunistic, automated attacks that probe only well-known ports and can make logs quieter, but a determined attacker with a full port scan or service fingerprinting will still find and identify the service. For that reason, a nonstandard port can be a minor supplementary measure at most, and real protection still depends on firewall rules that limit which hosts can reach the port, strong authentication, least-privilege accounts, and encrypted connections. Treating the change as sufficient on its own fails because scanners can probe all 65,535 TCP ports and identify services by their responses, not just by port number. Disabling TLS because the port is unusual fails because anyone able to capture the traffic can read it regardless of the port in use; encryption protects content, and port selection does nothing for confidentiality. Claiming the change creates a separate security zone confuses port numbers with segmentation; segmentation means separating networks and controlling traffic between them with routing and filtering, which a port change does not do. Exam caveat: obscurity is never accepted as a primary control on the exam. Operational check: document the new ports, keep restrictive source-address rules and TLS in place, and confirm with a scan from an unauthorized network segment that the service is unreachable.