SY0-701 Question 150
Single answerA company is moving a customer-facing application from an on-premises data center to a hybrid architecture. The web front end will run in containers in a public cloud, while the payment-processing database must remain on-premises for regulatory reasons. The security team wants to reduce manual network changes, keep segmentation consistent across both environments, and clearly define which security tasks are handled by the cloud provider versus the company. Which action would BEST meet these requirements?
- A
Deploy software-defined networking (SDN) to centrally manage segmentation policies across the hybrid environment, and document a shared responsibility matrix that identifies provider and customer security duties
- B
Move the payment-processing database into the same cloud container platform as the web front end so the cloud provider becomes fully responsible for database security and compliance
- C
Use a decentralized network design in which each application team manages its own firewall rules independently, eliminating the need for a formal responsibility matrix
- D
Keep all workloads on-premises because hybrid environments cannot maintain consistent segmentation controls between cloud and local data centers
Show answer and explanation
Correct answer: A
Explanation
The best answer is the option that combines centralized, software-driven policy enforcement with clear accountability for security responsibilities. In hybrid architectures, organizations commonly need to coordinate controls across on-premises and cloud resources. SDN supports this by abstracting network control from hardware and enabling centrally managed, programmable segmentation. This aligns with Security+ objectives around architecture and infrastructure concepts, including cloud, hybrid considerations, centralized management, and SDN.
Just as important, cloud security depends on understanding the shared responsibility model. Although details vary by provider and service type, major providers such as AWS, Microsoft Azure, and Google Cloud all publish documentation showing that the provider secures the underlying cloud infrastructure, while the customer remains responsible for items such as data protection, IAM configuration, secure workload configuration, and application-level controls. In practical terms, documenting a responsibility matrix helps prevent security gaps during migration and operations.
Relevant best-practice references include the cloud shared responsibility guidance published by AWS, Microsoft Azure, and Google Cloud, as well as NIST guidance on cloud computing and zero trust concepts that emphasize clear control ownership, segmentation, and centralized policy management in distributed environments.
- A. Correct.
Correct. SDN allows administrators to define and centrally manage network behavior and segmentation through software rather than relying solely on manual device-by-device configuration. In a hybrid environment, this helps maintain more consistent policies across cloud and on-premises resources and reduces operational overhead. A shared responsibility matrix is also essential in cloud and hybrid deployments because the cloud provider is responsible for some aspects of security, while the customer remains responsible for others, such as data, identity configuration, workload hardening, and access control, depending on the service model.
- B. Incorrect.
Incorrect. Keeping regulated data on-premises may be a business or compliance requirement, so moving the database to the cloud could violate stated constraints. In addition, the cloud provider does not become fully responsible for database security just because the workload is hosted in the cloud. Under the shared responsibility model, customers typically retain responsibility for data classification, account permissions, encryption configuration, and many platform or application-level controls.
- C. Incorrect.
Incorrect. A decentralized model can give individual teams more autonomy, but it does not inherently improve security consistency. In this scenario, the goal is to reduce manual network changes and keep segmentation consistent across hybrid environments, which is better supported by centralized policy management. A formal responsibility matrix is still needed in cloud deployments regardless of whether operations are centralized or decentralized.
- D. Incorrect.
Incorrect. Hybrid environments can maintain strong segmentation when designed properly using technologies such as SDN, virtual networks, security groups, ACLs, and centralized policy orchestration. The statement that hybrid environments cannot maintain consistent segmentation is false. Many organizations use hybrid architectures specifically to balance regulatory, operational, and business needs.