SY0-701 Question 8
Single answer1.2 Summarize fundamental security concepts.A healthcare company is deploying a new patient scheduling portal. The security architect wants to reduce the risk that a compromise of the web server will expose the internal database or other critical systems. The architect proposes placing the web server in a segmented network, allowing only required traffic to the database server, and preventing direct access from the internet to internal application servers. Which security concept is the architect primarily applying?
- A
Isolation and segmentation
- B
Non-repudiation
- C
Hashing
- D
Obfuscation
Show answer and explanation
Correct answer: A
Explanation
The best answer is isolation and segmentation because the scenario describes separating a public-facing service from sensitive internal resources and allowing only necessary communications. This aligns with fundamental security architecture principles such as reducing attack surface, limiting lateral movement, and enforcing least functionality and least privilege at the network level. In real environments, organizations often implement this through a DMZ, internal firewalls, ACLs, security groups, or microsegmentation. These practices are consistent with common guidance from NIST, including concepts in NIST SP 800-41 for firewalls and NIST SP 800-125/207 for segmentation and zero trust-related design principles. The other options are valid security concepts, but they do not directly address the primary architectural control being used in this scenario.
- A. Correct.
Correct. Isolation and segmentation are being applied by placing the public-facing web server in a separate network zone and tightly controlling communications to internal systems. This limits lateral movement, reduces attack surface, and supports containment if the web server is compromised. In practice, this is commonly implemented through DMZs, VLANs, firewalls, ACLs, and microsegmentation.
- B. Incorrect.
Incorrect. Non-repudiation is the assurance that a person or system cannot deny performing an action, typically supported by mechanisms such as digital signatures, strong authentication, and logging. The scenario is focused on limiting network exposure and controlling system-to-system access, not proving who performed an action.
- C. Incorrect.
Incorrect. Hashing is used to verify integrity or securely store password verifiers, depending on implementation. While hashing is an important security control, it does not address the architectural goal described in the scenario, which is to separate systems and restrict network paths between them.
- D. Incorrect.
Incorrect. Obfuscation makes code, data, or logic more difficult to understand, often to slow reverse engineering or hide implementation details. It does not primarily prevent a compromised web server from reaching internal systems or reduce exposure through network design.