An elections office publishes a citizen-facing website on the same DMZ as Workspace ONE Access. How should the security administrator place Access and the UEM API?
Select an answer to reveal the explanation.
Short Explanation
The ballot-info page is the front porch; Access and the UEM API are the records room. Give the management planes their own VIP and ACL so anonymous web never shares their door.
Full Explanation
When an elections office publishes a citizen-facing website on the same DMZ as Workspace ONE Access, place Access and the UEM API on a dedicated VIP and ACL separate from the public website subnet. The ballot-info page is the front porch; Access and the UEM API are the records room and must not share an anonymous door. Sharing the public website subnet and VIP with Access and the UEM API fails by concept because anonymous citizen traffic and management-plane services should not share the same front door. Bridging Access onto the anonymous public web VLAN with no ACL fails because identity infrastructure requires source and path controls, not an open public VLAN. Exposing the UEM API on the same HTTP listener as the voter-information site fails because API management endpoints must not share a listener with unauthenticated public content. Exam caveat: Workspace ONE Access and UEM API placement uses dedicated VIP and ACL separation from citizen web—not co-hosting on public subnets or listeners. Operational check: confirm citizen site remains on its VIP, Access and UEM API answer only on the dedicated VIP, and ACL denies anonymous public sources to those management endpoints. Record VIP and ACL objects in the elections DMZ diagram so campaign-season website changes do not fold Access back onto the public listener.