SY0-701 Question 103
Single answerMisconfigurationA company migrates an internal web application to a newly provisioned Linux server in its DMZ. Shortly after go-live, a security analyst discovers that the application is reachable from the internet over both HTTPS and SSH. The operations team confirms that administrators only need SSH access from the internal management subnet, and the web application should be publicly accessible only over HTTPS. A review of the server shows that the SSH service is installed and running, and the host-based firewall is enabled. Which action would BEST address the security issue caused by misconfiguration while preserving required administrative access?
- A
Disable the host-based firewall so it does not interfere with application traffic
- B
Restrict inbound SSH on the host-based firewall to the internal management subnet and leave HTTPS open to the internet
- C
Uninstall the SSH service entirely because any remote administration service in a DMZ is insecure
- D
Move the web server from the DMZ to the internal network so administrators can access it safely
Show answer and explanation
Correct answer: B
Explanation
The best answer is to restrict SSH access using the host-based firewall so only the internal management subnet can connect, while keeping HTTPS available publicly for the web application. This is a classic misconfiguration scenario: a service that should be limited to administrative networks is exposed to the internet. Security best practices emphasize least privilege, secure management plane separation, and system hardening by restricting administrative access paths. Guidance from organizations such as NIST supports limiting management access to authorized networks, reducing exposed services, and using layered controls such as host-based and network firewalls. In a real environment, this would often be implemented with host firewall rules, security groups, ACLs, or access through a bastion host, depending on the architecture.
- A. Incorrect.
This is incorrect. Disabling the host-based firewall would increase exposure and does not solve the underlying misconfiguration. Best practice is to use layered defenses, including host-based firewalls, to restrict management services. Removing the firewall would make the server less secure and could expose additional services unintentionally.
- B. Correct.
This is correct. The issue is a misconfiguration of access controls, not the mere presence of SSH. SSH can be appropriate for secure administration when access is limited to authorized sources such as a management subnet or jump host. Restricting inbound SSH to the internal management subnet while allowing HTTPS from the internet enforces least privilege and aligns the server configuration with business requirements.
- C. Incorrect.
This is incorrect. While removing unnecessary services is good hardening practice, the scenario states administrators require SSH access. Uninstalling SSH would break a valid operational need rather than correct the misconfiguration. The better solution is to limit SSH exposure to approved sources.
- D. Incorrect.
This is incorrect. Moving the web server to the internal network would undermine the purpose of the DMZ, which is to isolate public-facing services from the internal network. The problem is not server placement but improper access control on a management service. Re-architecting the network in this way would likely increase risk instead of reducing it.