Besides general industry guides, the parks department's PaaS database offers a vendor-published security baseline tailored to that managed service. What should the operations team do?
Select an answer to reveal the explanation.
Short Explanation
The folks who built the managed database also published a hardening checklist for it—use that, not invent everything from scratch. Vendor baselines sit next to general guides like CIS, not instead of common sense. Turning provider security off for speed or relying on cage locks alone misses the cloud control plane.
Full Explanation
Vendor-provided security baselines for a specific PaaS database complement general industry benchmarks with service-specific settings the provider recommends. Parks department operations should apply those vendor baselines where available alongside CIS-style guides so managed database security features are actually enabled and tuned for municipal data.
Ignoring vendor baselines because only custom on-site scripts are allowed discards tailored guidance. Disabling all provider security features to maximize raw performance weakens protections on parks data. Using only physical datacenter cage locks as the control for managed PaaS misunderstands cloud shared responsibility.
Exam caveat: general benchmarks + vendor baselines + organizational policy together form hardening; one source rarely covers every control. Re-apply after PaaS major version changes.
Operational check: download the vendor security baseline for the PaaS, implement recommended flags (TLS, auth, auditing), verify with provider advisor/security hub checks, and document deviations. Include the baseline ID/version in the parks database build record.
When the PaaS vendor updates its baseline, diff new recommendations against the parks database Terraform/parameters group and schedule a controlled apply so “set once” hardening does not rot across managed-service versions.