SY0-701 Question 7
Single answer1.2 Summarize fundamental security concepts.A healthcare company is deploying a new patient records application to a shared virtualization cluster. The security architect wants to reduce the risk that a compromise of the web front end could expose the database containing protected health information (PHI). The design must limit lateral movement, keep systems with different sensitivity levels separated, and follow a core security design principle rather than relying only on patching or monitoring. Which of the following is the BEST recommendation?
- A
Place the web server and database on the same virtual network so traffic stays internal to the cluster
- B
Implement network segmentation and isolate the database in a separate security zone with tightly restricted access from the web tier
- C
Increase log collection on both servers and review alerts daily for suspicious activity
- D
Deploy the application on the fastest available hosts to reduce the time attackers have to exploit the systems
Show answer and explanation
Correct answer: B
Explanation
The best answer is to implement network segmentation and isolate the database in a separate security zone with tightly controlled access. This applies fundamental security concepts covered in Security+, especially segmentation, isolation, and defense in depth. In a real-world architecture, the web tier and database tier should not share the same trust boundary when the database stores sensitive information such as PHI. Restricting communication to only necessary ports, protocols, and source systems reduces the attack surface and helps contain breaches. This aligns with widely accepted best practices from sources such as NIST guidance on network security architecture and system protection, including the use of segmentation, least privilege, and layered controls. Logging remains important as a detective control, but preventive architectural controls are the best primary recommendation in this scenario.
- A. Incorrect.
This is incorrect because keeping the web server and database on the same virtual network reduces separation between systems with different trust levels. If the web server is compromised, an attacker may have easier access to the database. Internal traffic is not automatically secure simply because it remains within a cluster; segmentation and access control are still necessary.
- B. Correct.
This is correct because segmentation and isolation enforce separation between components with different sensitivity levels and limit lateral movement. Placing the database in a separate security zone and allowing only specific required connections from the web tier reflects fundamental concepts such as segmentation, isolation, and minimizing attack surface. This is a strong preventive control that helps protect PHI if the web tier is compromised.
- C. Incorrect.
This is incorrect because logging and alerting are important detective controls, but they do not by themselves prevent unauthorized access or lateral movement. An organization should collect and review logs, but the scenario specifically asks for the best recommendation based on a core security design principle to separate sensitive assets.
- D. Incorrect.
This is incorrect because performance does not meaningfully address the security objective in the scenario. Faster hosts may improve application responsiveness, but they do not provide isolation, segmentation, or protection of sensitive data from a compromised web front end.