The county is hardening cloud-hosted workloads for records search. Which practice set best fits cloud infrastructure hardening?
Select an answer to reveal the explanation.
Short Explanation
Cloud hardening is the same common sense with a new address: clean images, no drive-by public IPs, and logging that actually runs. Public everything and shared spreadsheet passwords are how records search becomes headline news.
Full Explanation
Cloud workloads for municipal services harden along the same principles as on-premises systems, expressed through provider controls. Trusted or hardened images reduce inherited vulnerabilities compared with random public marketplace images. Restricting public IP assignment limits Internet exposure to only the fronts that must be reachable. Enforced logging—API activity, instance access, and security events—gives investigators evidence when something fails. Together these practices shrink blast radius and restore observability in accounts that often grow faster than traditional datacenters. Using outdated public images, attaching public IPs to every instance, and disabling logging to save cost maximizes exposure while destroying forensic visibility. Granting anonymous Internet admin to consoles and skipping image patching collapses identity and patch discipline. Storing cloud admin passwords in a shared spreadsheet and skipping network restrictions recreates credential sprawl without the compensating network gates cloud security groups and IAM were meant to provide. Exam caveat: cloud hardening questions emphasize golden images, least Internet exposure, and mandatory logging—not cost shortcuts that disable those controls. Operational check: boot only from approved hardened images, deny public IPs by default with break-glass exceptions, and confirm cloud audit logs flow to the city’s SIEM with alerts on console privilege use.