A PCI-adjacent payment helper subnet for a city cashiering integration must not freely reach the internet. Which network security design best meets sensitive-tier egress requirements?
Select an answer to reveal the explanation.
Short Explanation
Payment helpers do not get an open freeway ramp. Lock the outbound routes, allow only what the card flow needs, and inspect what still leaves—segment first, convenience later.
Full Explanation
A PCI-adjacent payment helper subnet for city cashiering must not freely reach the internet. Tightly controlling and inspecting egress—restrictive route tables, security groups and NACLs, plus firewall or proxy inspection patterns—meets sensitive-tier egress requirements. Assigning public IPs to every payment helper with 0.0.0.0/0 outbound for convenience contradicts segmentation. Placing payment helpers in the same subnet as public web scrapers with identical routes collapses trust boundaries. Disabling egress logging so investigations cannot see destinations undermines incident response and compliance evidence. Exam caveat: required payment endpoints still need allow-listed egress; overly broad denies can break settlement jobs if not inventorying destinations first. Operational check: remove default internet routes from the helper subnet, allow only approved destinations through the inspection point, attempt a forbidden outbound connection, and confirm flow logs or firewall logs record the deny. In municipal cloud governance, record the owners, success metrics, and rollback or restore contacts beside this technical choice so the next incident, budget review, or audit does not rediscover the decision from scratch under time pressure.