SY0-701 Security Architecture Practice Question
Exhibit
Cloud deployment summary: - Public API runs on an IaaS virtual machine - Database runs on a managed PaaS service - Object storage holds user uploads - Provider responsibility: datacenter, hardware, hypervisor, managed DB platform - Customer responsibility: guest OS, IAM, network rules, application code Finding: TCP/22 on the API VM is reachable from 0.0.0.0/0.
Based on the exhibit, what is the best security change to address the exposed management access on the cloud VM?
⚠ Common exam trap
CompTIA often tests the misconception that patching (Option A) or moving the service to a public IP (Option B) solves exposure issues, when the real security flaw is the lack of network segmentation and a controlled access point like a bastion host or VPN.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict SSH through a bastion host or VPN and remove direct internet access to the VM.
Exposing SSH directly to the internet on a cloud VM creates a significant attack surface, allowing brute-force and credential-stuffing attacks. A bastion host (jump box) or VPN provides a controlled, authenticated entry point, while removing direct internet access to the VM ensures management traffic is isolated and audited. This aligns with the principle of defense in depth and the AWS/cloud best practice of using a bastion host for administrative access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ask the provider to patch the guest operating system on the VM.
Why it's wrong here
In an IaaS model, the cloud provider's responsibility ends at the hypervisor and physical host; it does not extend to patching the guest OS, which is the customer's obligation. Requesting the provider to patch the guest OS is therefore not a viable action, as it falls outside the provider's scope and would not address the SSH exposure.
- ✗
Move SSH to a public IP on the VM so administrators can reach it more easily.
Why it's wrong here
Placing SSH on a public IP directly exposes the management interface to the entire internet, inviting brute-force attacks, credential stuffing, and exploitation of protocol vulnerabilities. It increases the attack surface rather than reducing it, and makes the VM more discoverable and vulnerable. A bastion or VPN is the appropriate way to give administrators access without public exposure.
- ✓
Restrict SSH through a bastion host or VPN and remove direct internet access to the VM.
Why this is correct
Restricting SSH through a bastion host or VPN eliminates the VM's direct internet exposure, forcing all management traffic to traverse a controlled, authenticated gateway. This reduces the attack surface by hiding the VM's SSH port from the public, adds logging and access control, and ensures only approved administrators with strong authentication can reach the management interface. It is the recommended security change for managing an IaaS VM.
- ✗
Enable object storage versioning to protect the VM from unauthorized logins.
Why it's wrong here
Object storage versioning is designed to preserve and recover historical versions of objects stored in cloud buckets, not to control administrative access to a VM. Enabling it would not prevent unauthorized SSH logins or mitigate the direct internet exposure of the management interface. To protect the VM, proper identity and access management, network controls, and authentication mechanisms are required.
Go deeper
Related to this question
Learn chapter
Cloud Security Fundamentals
Key term
Defense in depth
Defense in depth is a cybersecurity strategy that uses multiple layers of security controls to protect information and systems, so if one layer fails, another layer is already in place to stop the attack.
Key term
VPN
A VPN creates an encrypted tunnel over a public network to securely connect remote users or sites to a private network.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.