SY0-701 Question 97
Single answerCloud-specificA company is migrating a customer-facing web application to a public cloud provider. The security team must reduce the risk of data exposure from misconfigured storage while keeping administrative overhead low. The application stores invoices and account exports in cloud object storage, and some files have already been found accessible from the internet because of overly permissive settings. Which control would BEST address this risk?
- A
Enable a cloud security posture management (CSPM) solution to continuously detect and remediate publicly accessible storage configurations
- B
Deploy a host-based firewall on the virtual machines running the application to restrict inbound traffic
- C
Move the object storage buckets to a different cloud region to reduce exposure to external threats
- D
Increase the password complexity requirements for cloud administrator accounts
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use CSPM because the scenario centers on a cloud-specific risk: publicly accessible object storage caused by misconfiguration. Security+ expects candidates to distinguish between traditional controls and cloud-native controls. CSPM platforms continuously assess cloud resources against security baselines and can alert on or automatically remediate issues such as open storage buckets, weak IAM policies, and configuration drift. This aligns with common cloud provider best practices, including using automated configuration monitoring, enforcing least privilege, and blocking public access to storage unless explicitly required. Public cloud guidance from major providers commonly recommends account- or bucket-level public access blocks, policy review, and continuous posture monitoring to reduce the risk of accidental data exposure.
- A. Correct.
Correct. A cloud security posture management (CSPM) solution is specifically designed to identify insecure cloud configurations such as publicly accessible object storage, excessive permissions, and policy drift. In this scenario, the main issue is misconfigured cloud storage, so continuous assessment and remediation of storage settings directly addresses the root cause while keeping administrative overhead relatively low through automation and centralized visibility.
- B. Incorrect.
Incorrect. A host-based firewall can help protect virtual machines, but it does not control access to cloud object storage services. Object storage is typically accessed through cloud service policies, bucket/container permissions, access control lists, or public access settings rather than the guest operating system firewall on an application server. This is a plausible choice for someone focused on traditional infrastructure controls rather than cloud-native controls.
- C. Incorrect.
Incorrect. Changing the cloud region does not fix insecure permissions or public access settings. Publicly exposed storage remains publicly exposed regardless of geographic location. This option reflects a common misconception that location or segmentation alone resolves cloud misconfiguration issues.
- D. Incorrect.
Incorrect. Stronger administrator passwords are helpful for account security, but they do not directly prevent accidental public exposure caused by misconfigured storage policies. This option addresses identity security in general, not the specific cloud configuration weakness described in the scenario.