SY0-701 Question 147
Single answer3.1 Compare and contrast security implications of different architecture models.A healthcare company is redesigning its patient portal and supporting APIs. The security team must allow rapid scaling for seasonal demand, minimize the attack surface exposed to the internet, and reduce the blast radius if a public-facing component is compromised. The current proposal includes moving from a monolithic web application hosted on a single VM to a microservices-based architecture using containers, with an API gateway in front of the services and backend databases placed on a private subnet. Which architecture choice BEST meets these security goals?
- A
Deploy the monolithic application on a larger internet-facing VM so all components remain together and easier to manage
- B
Use a microservices architecture with an API gateway, place only the gateway in a public subnet, and isolate service containers and databases on private network segments
- C
Replace the application with a peer-to-peer architecture so each node can share processing load directly without centralized control
- D
Move all services, including databases, into a public subnet to simplify connectivity between components
Show answer and explanation
Correct answer: B
Explanation
The best answer is the microservices design with an API gateway as the only public-facing component and private segmentation for services and databases. From a Security+ perspective, this question focuses on comparing architecture models and understanding their security implications. A monolithic architecture can be easier to deploy, but it often creates a larger blast radius because tightly coupled components share the same trust boundary. A microservices architecture, when implemented properly, can improve fault isolation and limit the impact of compromise. However, microservices are not automatically more secure; they require strong controls such as service authentication, logging, secure orchestration, secrets management, and network segmentation.
Using an API gateway is a common best practice because it centralizes external access and supports security controls such as authentication, authorization, TLS termination, rate limiting, and request validation. Keeping application services and especially databases on private subnets follows standard cloud and network security guidance to minimize public exposure. This also supports defense in depth and least privilege by restricting which systems can communicate directly.
These design choices are consistent with guidance from sources such as NIST SP 800-207 on Zero Trust Architecture, which emphasizes reducing implicit trust and enforcing access control at multiple layers, and NIST SP 800-125/800-190, which discuss virtualization and container security considerations including isolation and reduced attack surface through segmentation.
- A. Incorrect.
This is incorrect. A monolithic application on a single internet-facing VM increases concentration of risk. If the host or application is compromised, multiple functions are exposed at once, increasing blast radius. While a monolith can be simpler operationally, it does not best support minimizing exposed components or isolating workloads compared with segmented microservices behind a controlled entry point.
- B. Correct.
This is correct. A microservices architecture can reduce blast radius by separating functions into smaller services, especially when combined with strong network segmentation. Placing only the API gateway in the public subnet minimizes internet exposure, while keeping containers and databases on private segments reduces attack surface. The gateway also provides a central point for authentication, rate limiting, logging, and request inspection. This design aligns well with zero trust and defense-in-depth principles.
- C. Incorrect.
This is incorrect. A peer-to-peer architecture is generally not appropriate for a healthcare patient portal that requires centralized policy enforcement, controlled data flows, and strong segmentation. Peer-to-peer models can complicate authentication, monitoring, and trust boundaries, and they typically increase the number of systems communicating directly with one another.
- D. Incorrect.
This is incorrect. Putting all services and databases in a public subnet significantly increases exposure and undermines segmentation. Databases should not be directly internet-accessible unless there is a very specific and carefully controlled need, which is not the case here. This option may simplify routing, but it creates unnecessary risk and does not reduce blast radius.