SY0-701 Question 157
Single answerServerlessA company uses a serverless architecture to process customer-uploaded images. When a file is placed in cloud object storage, a function is automatically triggered to resize the image and store the output in another bucket. During a security review, the team discovers the function's execution role allows broad access to multiple storage buckets and logging services across the account. The security architect wants to reduce the risk of abuse if the function is compromised, while keeping the workflow operational. Which action is the BEST recommendation?
- A
Apply least privilege to the function's execution role so it can access only the specific source bucket, destination bucket, and required logging actions
- B
Move the serverless function to a dedicated virtual machine so the company can fully manage the operating system and reduce cloud risk
- C
Store administrator credentials in the function's environment variables so the function can access any resource it needs during failures
- D
Increase the function timeout and memory allocation so it can complete processing before security controls interrupt execution
Show answer and explanation
Correct answer: A
Explanation
The BEST answer is to restrict the serverless function's execution role to only the resources and actions required for its task. In serverless security, one of the most important controls is strong identity and access management because the cloud provider manages the underlying infrastructure, while the customer remains responsible for securing code, permissions, secrets, and data access under the shared responsibility model. Broad permissions on a function create a larger blast radius and increase the impact of compromise, accidental misuse, or vulnerable code. Best practices from major cloud providers consistently recommend least-privilege IAM policies for functions, avoiding long-lived or embedded credentials, and granting only the minimum storage and logging permissions necessary for operation. This question tests practical application of least privilege in a serverless workflow rather than simple recall.
- A. Correct.
Correct. In a serverless environment, the execution role or identity assigned to the function should follow the principle of least privilege. Limiting permissions to only the required source bucket, destination bucket, and necessary logging actions reduces the blast radius if the function is exploited or misused. This is a core Security+ concept and aligns with cloud-provider guidance for IAM roles and serverless security.
- B. Incorrect.
Incorrect. Moving from serverless to a virtual machine does not inherently improve security and may increase the operational burden by requiring patching, hardening, and OS maintenance. The issue in the scenario is excessive permissions, which should be addressed with proper identity and access management rather than changing compute models.
- C. Incorrect.
Incorrect. Storing administrator credentials in environment variables is a poor security practice. It creates unnecessary exposure of highly privileged credentials and violates least privilege. Serverless functions should use scoped execution roles or managed identities instead of embedded admin credentials whenever possible.
- D. Incorrect.
Incorrect. Increasing timeout and memory addresses performance or reliability concerns, not excessive access permissions. The risk described is that the function could abuse broad access if compromised. Resource allocation changes do not reduce that risk.