A county launches a new public permitting portal and wants to catch misuse quickly after go-live. Which mitigation pairs best with the new exposure?
Select an answer to reveal the explanation.
Short Explanation
A brand-new public front door needs eyes on it from day one—like putting cameras up the same night you unlock a new store. Monitoring and alerts turn weird logins and traffic into early warnings instead of quiet surprises. Skipping logs just because the site is new is asking for blind spots.
Full Explanation
Newly exposed Internet-facing municipal services change the residual risk picture the moment DNS resolves and certificates go live. Continuous monitoring and alerting on authentication failures, abuse patterns, and anomalous traffic give the county a detective control that matches that new exposure: credential stuffing, scraping, and odd request volume become visible within minutes instead of weeks. Security+ treats monitoring as an enterprise mitigation technique that pairs with preventive hardening—logging and alerting do not replace secure design, but they close the gap between "reachable" and "known to be abused." Operationally, feed portal auth and edge telemetry into the SOC or SIEM with thresholds for lockouts, geographic anomalies, and sudden spike rates, and verify that on-call staff receive actionable alerts before citizens notice outages.
Disabling logging for the first ninety days to save storage inverts the risk model. Storage cost is secondary to detection debt; without logs you cannot investigate compromise, support incident response, or prove due diligence after a complaint. Replacing the public portal with an air-gapped kiosk inside city hall removes the intended citizen service rather than mitigating residual Internet risk—architecture should enable the mission securely, not cancel it. Publishing the admin password on the intranet collapses least privilege and confidentiality; shared static credentials invite lateral misuse and make accountability impossible.
Exam caveat: questions often tempt "reduce cost" or "simplify access" distractors after a launch. Prefer the control that restores visibility for a newly public attack surface. After go-live, confirm collectors are receiving events, dashboards cover the portal hostname, and a test failed login produces an alert within the agreed SLA.