SY0-701 Question 195
Single answerComputeA company is moving a customer-facing web application from on-premises virtual machines to a public cloud provider using infrastructure as a service (IaaS). The security team must reduce the risk of attackers abusing the instance metadata service to steal temporary credentials from compromised workloads. Which of the following is the BEST control to implement?
- A
Require the use of the cloud provider's token-protected metadata service version and disable older unauthenticated metadata access
- B
Enable full-disk encryption on each virtual machine so metadata responses cannot be intercepted in memory
- C
Move the application to a software as a service (SaaS) platform so the metadata service no longer exists
- D
Place the instances behind a web application firewall (WAF) to block all requests to link-local IP addresses
Show answer and explanation
Correct answer: A
Explanation
The best answer is to require the cloud provider's token-protected metadata service and disable legacy unauthenticated metadata access. In cloud compute security, instance metadata services are a well-known target because they can expose temporary credentials, identity information, and configuration details to code running on a virtual machine. Attackers commonly exploit SSRF vulnerabilities in web applications to query metadata endpoints. Major cloud providers document hardened metadata options specifically to mitigate this risk, such as AWS Instance Metadata Service Version 2 (IMDSv2), which requires session-oriented tokens and is recommended over IMDSv1. This aligns with Security+ objectives around securing compute resources in virtualized and cloud environments using provider-native hardening controls, least privilege, and defense in depth. Encryption at rest, WAFs, and wholesale service-model changes may be useful in other contexts, but they do not directly and effectively address metadata abuse on IaaS instances.
- A. Correct.
Correct. In IaaS environments, instance metadata services can expose temporary credentials or configuration data to workloads running on the instance. Requiring the newer, token-protected metadata service and disabling older unauthenticated access is a direct mitigation against server-side request forgery (SSRF) and similar attacks that attempt to query metadata endpoints. This is a practical compute-security control because it hardens the virtual machine's interaction with cloud metadata rather than relying on indirect protections.
- B. Incorrect.
Incorrect. Full-disk encryption protects data at rest, such as virtual disk contents if storage media is stolen or improperly decommissioned. It does not prevent a running process from accessing the metadata service or stop credentials from being retrieved from memory or over the local network path. This option reflects a common misconception that encryption at rest mitigates active runtime attacks.
- C. Incorrect.
Incorrect. Moving to SaaS changes the service model, but it is not a realistic security control for this scenario because the requirement is to secure workloads being deployed on IaaS compute instances. Also, changing service models does not inherently address the immediate attack path in the existing design. This distractor tests whether the candidate can distinguish between architectural replacement and an appropriate tactical control.
- D. Incorrect.
Incorrect. A WAF can help filter inbound web traffic to an application, but it is not the best control for preventing a compromised workload from making local requests to the instance metadata service. Metadata endpoints typically use link-local addresses accessible from the instance itself, and a WAF in front of the application does not reliably stop local SSRF or internal process access. Network egress filtering and host-based controls may help, but the direct best practice is to require the hardened metadata service mode.