SY0-701 Question 149
Single answerA company is modernizing a customer-facing application by moving the web tier to containers running in a public cloud while keeping the payment-processing database on-premises to meet internal compliance requirements. The security team wants microsegmentation between application components, consistent traffic policy enforcement across the hybrid environment, and a clear understanding of which security tasks remain with the company versus the cloud provider. Which of the following is the BEST solution to meet these requirements?
- A
Deploy software-defined networking (SDN) controls for centralized policy management across the hybrid environment, keep the database on-premises, and use the cloud shared responsibility matrix to define provider versus customer security duties
- B
Move the payment-processing database into the same cloud container platform as the web tier because the cloud provider is fully responsible for securing all workloads hosted in its environment
- C
Replace the containerized web tier with traditional virtual machines on-premises because decentralized infrastructure provides better default segmentation and eliminates shared responsibility concerns
- D
Use a single flat VLAN spanning the cloud and on-premises network so container traffic can flow without additional policy layers, and rely on the provider's perimeter firewall for east-west traffic control
Show answer and explanation
Correct answer: A
Explanation
The best answer is the hybrid approach that combines containerization in the cloud with an on-premises database, managed through SDN and governed by the cloud shared responsibility model. In real-world Security+ scenarios, candidates must recognize that hybrid designs are often chosen to balance modernization goals with regulatory or internal compliance constraints. SDN is appropriate because it supports centralized policy management and microsegmentation, both of which are important in containerized and hybrid environments where workloads are dynamic and east-west traffic is significant. The shared responsibility matrix is equally important: for IaaS, PaaS, and SaaS, the exact split differs, but the customer never offloads all security responsibilities. This aligns with common cloud-provider guidance and industry best practices from sources such as AWS Shared Responsibility Model documentation, Microsoft Azure Shared Responsibility guidance, and Google Cloud shared responsibility documentation. Best practice also discourages flat network designs across hybrid environments and emphasizes least privilege, segmentation, and explicit understanding of provider versus customer control ownership.
- A. Correct.
Correct. This option addresses all stated requirements. SDN enables centralized, software-driven network policy and microsegmentation, which is useful for controlling east-west traffic between containers and across hybrid environments. Keeping the payment database on-premises aligns with the scenario's compliance constraint. Using the cloud shared responsibility model is also essential because in public cloud deployments, the provider secures components of the underlying infrastructure, while the customer remains responsible for items such as identity, configuration, data protection, workload hardening, and network policy depending on the service model.
- B. Incorrect.
Incorrect. This reflects a common misconception about cloud security. A cloud provider is not fully responsible for securing customer workloads. Under the shared responsibility model, customers are still responsible for many controls, including data classification, IAM configuration, secure workload configuration, patching in many service models, and network security settings. Moving the payment database to the cloud may also violate the scenario's compliance requirement to keep it on-premises.
- C. Incorrect.
Incorrect. Moving everything back on-premises does not best satisfy the business requirement to modernize using containers in the public cloud. Decentralized infrastructure does not inherently provide better segmentation; segmentation depends on architecture and control implementation. It also does not eliminate responsibility for security operations. On-premises environments place even more direct responsibility on the organization for infrastructure and security management.
- D. Incorrect.
Incorrect. A flat VLAN across cloud and on-premises environments increases the attack surface and weakens segmentation. It conflicts with the requirement for microsegmentation and consistent policy enforcement. Perimeter firewalls are not sufficient for controlling east-west traffic between application components, especially in containerized environments where granular, workload-level policy is needed.