A municipal database administration UI similar to phpMyAdmin is reachable without MFA and with broad network access. What is the correct finding emphasis?
Select an answer to reveal the explanation.
Short Explanation
The control panel for the filing cabinets is not a tourist attraction. DB admin UIs can read, change, or wipe the data store — treat them like vault doors. Obscure hostnames and shared proxies are not MFA.
Full Explanation
Database administration UIs are crown jewels and require strict access control and strong authentication. A municipal phpMyAdmin-like interface reachable without MFA and with broad network access offers near-direct paths to citizen data and schema changes—exactly the opposite of least privilege for public-sector data stores.
DB admin UIs are high value, not low value “schema only.” Obscure hostnames do not make MFA optional. Sharing a reverse proxy with the public site does not make such tools safe without authZ and network controls.
Exam caveat: never expose DB consoles broadly; prefer break-glass access, SSO/MFA, and tight IP allowlists. CPTS web/common-app scoring should elevate DB admin exposure findings for civic data protection.
Operational check: restrict the UI to admin networks or remove it, enforce MFA, audit who can reach it, rotate exposed DB credentials, and confirm broad network paths are closed. If a DB admin UI must exist for municipal break-glass work, place it on a PAM-brokered path with session recording and short-lived access. Broad network reachability to DB UIs contradicts least privilege for municipal data guardianship. Cite the control owner in the civic remediation plan.