SY0-701 Question 250
Single answer4.1 Given a scenario, apply common security techniques to computing resources.A company is migrating several customer-facing applications to a public cloud provider. During a security review, the administrator discovers that a virtual machine hosting a web application has a public IP address, port 22 open to the internet, and an attached storage volume that contains database exports in plaintext. The security team wants to reduce the attack surface and better protect data on this workload without changing the application code. Which action would BEST address the most immediate security risks?
- A
Place the virtual machine in a private subnet, restrict SSH access to a bastion host or management network, and enable encryption on the attached storage volume
- B
Increase the virtual machine's CPU and memory allocation so the system can better handle malicious traffic and encrypt the database exports later
- C
Install a host-based anti-malware agent and leave the public IP and SSH exposure unchanged so administrators can continue direct remote access
- D
Disable logging on the virtual machine to reduce the amount of sensitive operational data stored on disk and rely on perimeter firewall rules alone
Show answer and explanation
Correct answer: A
Explanation
The best answer is to reduce the workload's attack surface and protect sensitive stored data using built-in infrastructure security controls. In public cloud environments, security best practices commonly include avoiding public exposure for systems that do not require it, placing workloads in private subnets where possible, tightly controlling administrative access through bastion hosts, jump boxes, VPNs, or dedicated management networks, and encrypting data at rest on attached storage volumes. This aligns with widely accepted guidance from cloud security best practices and the principle of least privilege. The scenario specifically says the team wants improvements without changing application code, which makes network segmentation, access restriction, and storage encryption the most appropriate immediate controls. Anti-malware and logging can support a broader security posture, but they do not address the most urgent misconfigurations identified here as effectively as reducing external exposure and encrypting the stored data.
- A. Correct.
Correct. This option applies common security techniques to cloud computing resources by reducing exposure and protecting data at rest. Moving the VM to a private subnet limits direct internet reachability, restricting SSH to a bastion host or approved management network reduces administrative attack surface, and enabling storage encryption protects sensitive database exports on the attached volume. These are practical compensating controls that do not require application code changes.
- B. Incorrect.
Incorrect. Increasing compute resources does not meaningfully address the identified security issues. More CPU and memory may improve performance, but they do not reduce external exposure or protect plaintext data stored on the volume. Delaying encryption leaves sensitive exports vulnerable if the storage is accessed or compromised.
- C. Incorrect.
Incorrect. Host-based anti-malware can be useful as part of defense in depth, but it does not resolve the primary risks in this scenario: unnecessary internet exposure of management services and unencrypted sensitive data. Leaving SSH open to the internet preserves a common attack vector, including password attacks and exploitation of misconfigurations.
- D. Incorrect.
Incorrect. Disabling logging weakens security monitoring, incident response, and accountability. Best practice is typically to centralize and protect logs, not remove them. Perimeter firewall rules alone are also insufficient when the VM itself has a public IP and exposed administrative access.