An external scan shows a production database server's listener port is reachable from any internet address. The database serves only two application servers in the same data center. Which change most directly reduces this exposure?
Select an answer to reveal the explanation.
Short Explanation
Think of your database port as a door that only two people should ever knock on. The fix is a firewall rule that lets those two in and turns everyone else away at the street. Moving the door to a weird spot or adding a better lock still leaves it facing the whole internet.
Full Explanation
Network exposure is controlled by limiting which sources can reach a service. Because only two application servers need the database, a firewall (network or host based) should permit the listener port solely from their addresses and deny everything else, so internet hosts can no longer even open a connection. This removes the service from the external attack surface rather than defending it after an attacker connects. Moving the listener to a nonstandard port is obscurity: port scanners sweep all ports and fingerprint services, so the database remains reachable and discoverable. Strong passwords and lockout make credential guessing harder, but the server stays exposed to brute-force attempts, to vulnerabilities in the listener itself, and to denial of service, and lockout can be abused to lock legitimate accounts. TLS protects confidentiality and integrity in transit, but it does not restrict who can connect; an internet attacker can still complete a TLS handshake and attack authentication or the listener. Exam caveat: all four are reasonable controls in general, but the question asks what removes the exposure, and only source restriction does that. Operational check: repeat the external scan and confirm the port is filtered, then confirm both application servers still connect.