Citizen PII volumes for a benefits app must use encryption and must not be reachable over the public internet. What should provisioning enforce?
Select an answer to reveal the explanation.
Short Explanation
Citizen PII is the locked filing cabinet in a room with no street door—encrypt it and keep the network path private. Public ACLs and cleartext disks miss both marks.
Full Explanation
Encryption for data at rest plus private endpoints or private connectivity only is the provisioning posture that fits citizen PII volumes for a benefits app that must not be reachable over the public internet. Security requirements drive both cryptographic and network placement controls. Public read ACLs with optional client-side renaming only fail confidentiality. Cleartext disks attached to internet-facing jump hosts fail both encryption and exposure rules. Unencrypted snapshots shared to partner accounts by default expand blast radius and violate least privilege. Exam caveat: PII questions often combine encryption at rest with private networking—do not pick only one when the stem requires both. Operational check: enable customer-managed or provider keys per policy, deny public ACLs via organization guardrails, provision private endpoints, and verify from a public probe that benefits data planes refuse connections. In municipal platform operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand the failure modes avoided for citizen services. Re-check the decision after the next provider feature change or compliance update to ensure the same answer still holds for the city's estate.