A team is deploying a containerized API to a public cloud. The service must be reachable only by internal corporate applications, and secrets must not be embedded in images or readable as plaintext by administrators of the underlying host. Which two actions best fit the design? Select two.

Give each container a public IP and restrict access by source IP allowlist.

Source IP filtering may reduce exposure, but public IPs still make the service broadly addressable and easier to scan or attack. The scenario explicitly says the service must be reachable only by internal applications, so keeping it private is a better architectural choice than relying on external allowlists alone.

Bake database passwords into the container image so deployment is simpler.

Embedding secrets in an image is risky because the image may be copied, cached, scanned, or retained long after deployment. Anyone with access to the image can potentially extract the password. Simplicity does not outweigh the security and lifecycle problems created by hardcoded credentials.

Assume the cloud provider's tenant isolation alone is enough to protect secrets from misuse.

Tenant isolation protects one customer from another, but it does not solve application-level secret handling or misuse by authorized insiders. The scenario requires the secrets not be readable in plaintext from the host or image, which calls for explicit secret management and permission controls, not trust in isolation alone.

What does this SY0-701 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Place the API in a private subnet and expose it only through an internal load balancer or private endpoint. — The best design keeps the API private and uses a dedicated secret-management service. Private networking ensures the service is reachable only from approved internal systems, while the vault-based secret pattern keeps credentials out of images and prevents plaintext exposure during deployment. Combined, these controls address both access scope and secret protection without relying on weak compensating measures. Why others are wrong: Public IPs with allowlists still leave the service directly exposed and increase the attack surface. Baking passwords into images is insecure because images are copied and cached. Tenant isolation is important, but it does not replace application-level controls for secrets or internal-only access. The scenario needs intentional design, not assumptions about the cloud environment.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.