A city IT team is hardening two workloads: a public static website for park permits and a private database holding citizen payment records. Which control pairing best matches exposure and data sensitivity?
Select an answer to reveal the explanation.
Short Explanation
Think of the park-permits site like a storefront on Main Street and the payment database like the vault in the back. The storefront can use a CDN and WAF to soak up junk traffic; the vault stays off the public street with tight NSG rules and no public IP. Same city, totally different exposure.
Full Explanation
For civic workloads that differ in exposure and sensitivity, front the public park-permits static website with a CDN and WAF, and keep the citizen-payment database private with network security group (or equivalent) rules and no public IP. Edge filtering matches Internet-facing static content; private placement matches payment-record sensitivity. That pairing is the control design the exam expects when a city IT team hardens mixed tiers together. Placing both workloads on the public Internet with identical open security groups optimizes for operational simplicity at the expense of data classification and maximizes blast radius if either tier is probed. Putting the database behind a CDN and WAF while leaving the website on a raw public IP reverses the model: relational payment data is not edge-cacheable static content, and the public site still needs volumetric and Layer-7 protection. Disabling encryption on website objects and relying only on a bastion in front of the database weakens confidentiality for public assets and still fails to describe a complete private-data posture. Exam caveat: shared responsibility does not imply one identical posture for every workload—match controls to exposure and sensitivity rather than to convenience. Operational check: confirm the origin is reachable only through CDN/WAF paths, verify the database subnet has no public IP and denies 0.0.0.0/0, test bastion-mediated admin access only, and record the public-versus-vault zoning in the municipal change ticket so future on-call staff apply the same pairing.