A vulnerability scan of the city network shows several unused services reachable from the Internet through overly broad firewall rules. What enterprise-capability change best reduces that unnecessary exposure?
Select an answer to reveal the explanation.
Short Explanation
If the scan shows doors that nobody uses still standing open to the Internet, close them—tighten the firewall rules and ACLs to least exposure. Spreadsheets without change control and opening more ports just make it worse.
Full Explanation
Tightening firewall rules, ports, and ACLs so only required services remain reachable is the correct enterprise-capability change when vulnerability scans show unused Internet-exposed openings. Least functionality at the municipal perimeter shrinks attack surface, removes accidental legacy allows, and forces every public path to map to a documented citizen or business service. That reduction of unnecessary exposure is a core network security hygiene outcome after discovery scanning.
Opening every remaining port so scanners finish faster next time deliberately increases exposure and inverts the finding. Moving the firewall rule base into a shared spreadsheet without change control breaks peer review, rollback, and audit trails. Disabling logging on allow rules hides who abused the exposure and impairs investigations without closing the holes scanners already flagged.
Exam caveat: rule tightening must preserve necessary public services—pair removals with change tickets, backups of prior configurations, and post-change external validation scans. Host hardening and perimeter ACL reduction are complementary; exams may test either layer.
Operational check: inventory each public allow with an owner and service justification, remove or restrict unused entries, rescan from an external vantage point, monitor deny hits for legitimate municipal workflows that need narrowly scoped exceptions, and document residual accepted exposure.