SY0-701 Question 96
Select 2Cloud-specificA company is migrating a customer-facing application to a public cloud provider. The security team must ensure that administrative access to cloud resources is tightly controlled and that a compromise of a developer's password alone will not allow changes to production systems. At the same time, the company wants to avoid embedding long-term credentials in scripts running on cloud-hosted virtual machines. Which TWO controls best meet these requirements?
- A
Require multifactor authentication (MFA) for privileged cloud accounts and administrative console access
- B
Assign an instance role or managed identity to the virtual machines so scripts can obtain temporary credentials
- C
Create one shared administrator account for the operations team and store the password in an encrypted document
- D
Generate long-term access keys for each virtual machine and place them in local configuration files with restricted permissions
- E
Expose the cloud provider's metadata service directly to the internet so administrators can retrieve credentials remotely
Show answer and explanation
Correct answers: A, B
Explanation
The best answers are requiring MFA for privileged cloud accounts and using instance roles or managed identities for workloads. Together, these controls address two major cloud-specific security concerns: protecting administrative access and eliminating hard-coded or long-term credentials on compute instances. This aligns with common cloud-provider guidance and Security+ objectives around identity and access management, least privilege, and secrets management. Major providers such as AWS, Microsoft Azure, and Google Cloud all recommend MFA for administrative users and the use of roles, managed identities, or service accounts that issue temporary credentials to workloads instead of storing static access keys on systems. Shared accounts and embedded long-term credentials are common operational shortcuts, but they weaken accountability and increase the likelihood of credential compromise.
- A. Correct.
This is correct. Requiring MFA for privileged access is a core cloud security best practice because it reduces the risk that a stolen or reused password can be used by itself to administer production resources. In a cloud environment, privileged accounts often control networking, storage, identity, and compute services, so adding MFA significantly strengthens access control. This directly addresses the requirement that a compromised developer password alone must not permit production changes.
- B. Correct.
This is correct. Using an instance role or managed identity allows cloud-hosted workloads to receive temporary credentials from the cloud provider instead of storing static secrets in code, scripts, or configuration files. This follows the principle of minimizing long-term credentials and supports centralized permission management. In major cloud platforms, these identities are designed specifically so applications on virtual machines can securely access cloud APIs without embedded keys.
- C. Incorrect.
This is incorrect. Shared administrator accounts reduce accountability and make auditing difficult because actions cannot be tied to an individual user. Even if the password is encrypted at rest in a document, the approach still relies on a shared secret and does not satisfy strong identity and nonrepudiation requirements. A common misconception is that encrypting a shared password is enough, but shared privileged accounts remain a poor security practice.
- D. Incorrect.
This is incorrect. Long-term access keys on virtual machines increase the risk of credential theft, reuse, and accidental exposure through backups, logs, or compromised hosts. Restricted file permissions help somewhat, but they do not eliminate the problem of static secrets stored on disk. Cloud security best practices favor temporary credentials delivered through roles or managed identities instead of embedding permanent keys.
- E. Incorrect.
This is incorrect. The instance metadata service is intended to be accessed locally by the workload running on the instance, not exposed externally. Making it reachable from the internet would create a major attack surface and could allow unauthorized credential access. A candidate might choose this option if they misunderstand how metadata services work in cloud platforms, but remote exposure is the opposite of the intended security model.