A city recreation portal will process cardholder data and must land in architectures and controls suited to that obligation. What drives the provisioning choices?
Select an answer to reveal the explanation.
Short Explanation
Taking credit cards is like handling cash in a vault—the building layout and cameras have to match the rules. PCI-style compliance shapes segmentation, logging, and controls more than button colors.
Full Explanation
Compliance requirements such as PCI-aware segmentation, logging, and control selection drive provisioning when a city recreation portal processes cardholder data; the obligation shapes architecture before convenience features do. Marketing color themes for the checkout button fail as provisioning drivers for cardholder environments. Cheapest global anycast DNS regardless of controls fails because cost and DNS reach do not satisfy PCI-oriented segmentation and logging needs. Disabling encryption to simplify certificate renewals fails confidentiality and compliance controls outright. Exam caveat: regulated data obligations constrain network segmentation, encryption, logging, and key management—pick compliance-driven answers when cardholder data is in the stem. Operational check: define a CDE-like boundary, enable required logging, encrypt in transit and at rest, restrict admin paths, and evidence controls for municipal assessors before go-live. In municipal platform operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand the failure modes avoided for citizen services. Re-check the decision after the next provider feature change or compliance update to ensure the same answer still holds for the city's estate.