SY0-701 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Patch and harden the Linux virtual machine operating system.

  Why this is correct

  In Infrastructure as a Service (IaaS), the cloud provider secures the physical host and hypervisor, but the customer retains administrative control over the guest OS, including the kernel, installed packages, and running services. Patching known CVEs and applying security hardening measures (e.g., disabling unnecessary services, enabling SELinux/AppArmor, enforcing minimum file permissions) directly reduce the VM's attack surface. This responsibility falls squarely on the customer under the shared responsibility model because the VM is effectively a customer-managed server, and failing to patch leaves known exploitable vulnerabilities.

• ✗

  Replace the provider's datacenter controls with a customer-owned firewall appliance.

  Why it's wrong here

  The customer cannot override or replace the provider's physical datacenter controls, such as biometric entry, video surveillance, redundant power, and fire suppression, because those are inherent to the provider's facility and are shared across all tenants. In IaaS, the customer can deploy virtual network security appliances (like a firewall VM) to filter traffic within its own virtual network, but that does not substitute for the provider's physical security layer. Attempting to 'replace' provider controls confuses the logical network layer with the physical facility layer; both are necessary but owned and managed by different parties.

• ✗

  Assume the provider will apply tenant-specific application permissions automatically.

  Why it's wrong here

  Application-level permissions—such as which users, roles, or services can invoke APIs, read or write data, or trigger functions—are not inferred or automatically provisioned by the cloud provider based on tenant identity. In IaaS, the customer must explicitly configure identity and access management (IAM) policies, roles, and resource policies, because the provider only enforces policies that the customer creates. Relying on the provider to guess tenant-specific permissions would be dangerously incorrect: the provider cannot know the customer's intended business logic or least-privilege requirements, and such an assumption would violate the shared responsibility model where configuration is customer-driven.

• ✓

  Configure IAM roles, bucket policies, and least-privilege access for the customer's resources.

  Why this is correct

  When storing data in cloud object storage (e.g., S3 buckets) or using other resources, the customer must explicitly define IAM roles, bucket policies, and resource-based policies to enforce least-privilege access, because the provider does not automatically restrict access based on the data's sensitivity. Misconfigured policies are a leading cause of data breaches, such as accidentally public read/write buckets, so precisely specifying principals, allowed actions, and conditions (like IP ranges or MFA) is critical. This is a core customer responsibility under the shared responsibility model, and it directly controls the confidentiality and integrity of the customer's stored data.

• ✗

  Rely on the cloud provider to classify the company's documents for compliance.

  Why it's wrong here

  Data classification is a business-driven process that involves determining the sensitivity of documents (e.g., PII, PHI, trade secrets) and applying appropriate labels, retention rules, and encryption requirements; the provider has no context to make those judgments on behalf of the customer. Even if the provider offers scanning or tagging tools, it cannot determine the company's specific regulatory obligations or define what constitutes protected data under GDPR, HIPAA, or internal policy. Compliance accountability ultimately rests with the customer as the data controller, so the provider's generic infrastructure cannot substitute for the customer's classification and governance controls.

Go deeper

Related to this question