SY0-601 Architecture & Design 3 — Questions and Answers
Question 1: A developer stores secrets such as API keys and database passwords directly in application configuration files checked into source control. Which secure design practice should be enforced instead?
- Encrypt the configuration files with AES-256
- Use environment variables or a secrets management vault (Correct answer)
- Restrict repository access to senior developers only
- Hash all secrets before storing them in config files
Correct answer: Use environment variables or a secrets management vault
Secrets should be stored in a dedicated secrets manager or injected via environment variables, never hardcoded in source-controlled files.
Question 2: Which software development concept involves running an application with only the permissions it needs to perform its function and no more?
- Input validation
- Principle of least privilege (Correct answer)
- Secure defaults
- Code signing
Correct answer: Principle of least privilege
The principle of least privilege limits an application's permissions to the minimum required, reducing the blast radius if the application is compromised.
Question 3: A company's serverless functions are triggered by events and execute in ephemeral containers. Which cloud security concept describes ensuring these workloads are protected even though they have no persistent OS to harden?
- Infrastructure as code (IaC) scanning
- Serverless security / function-level isolation (Correct answer)
- Container escape prevention
- VM-based hypervisor hardening
Correct answer: Serverless security / function-level isolation
Serverless security focuses on securing function code, permissions, and event sources rather than the underlying OS, which is managed by the provider.
Question 4: An organization uses containers for its microservices. A security review finds that all containers run as root. Which remediation BEST reduces risk?
- Switch from Docker to Kubernetes
- Run containers with a non-root user and read-only filesystem (Correct answer)
- Encrypt container images at rest
- Implement network policies between pods
Correct answer: Run containers with a non-root user and read-only filesystem
Running containers as non-root with a read-only filesystem limits the damage an attacker can do if they exploit a vulnerability inside the container.
Question 5: A security engineer recommends enabling Secure Boot on all enterprise endpoints. What threat does Secure Boot primarily mitigate?
- Ransomware encrypting user files
- Bootkit and rootkit infections that persist below the OS (Correct answer)
- Brute-force attacks on local user accounts
- Phishing emails that deliver malware
Correct answer: Bootkit and rootkit infections that persist below the OS
Secure Boot uses cryptographic signatures to verify that the bootloader and OS kernel have not been tampered with, preventing bootkits from loading before the OS.
Question 6: Which architecture pattern improves resilience by designing systems to continue operating in a degraded but functional state when a component fails, rather than failing completely?
- High availability clustering
- Graceful degradation (Correct answer)
- Active-active failover
- Load balancing
Correct answer: Graceful degradation
Graceful degradation ensures that a system continues to provide core functionality even when non-critical components fail.
Question 7: A company uses Infrastructure as Code (IaC) to provision cloud resources. Which security practice should be integrated into the IaC pipeline to catch misconfigurations before deployment?
- Manual peer code review of every template
- Static analysis / policy-as-code scanning of IaC templates (Correct answer)
- Penetration testing of deployed infrastructure
- Runtime CSPM monitoring after deployment
Correct answer: Static analysis / policy-as-code scanning of IaC templates
Static IaC scanning (policy-as-code) analyzes templates before deployment to catch misconfigurations such as open S3 buckets or overly permissive IAM policies.
SY0-601 Architecture & Design 3
A developer stores secrets such as API keys and database passwords directly in application configuration files checked into source control.
Which secure design practice should be enforced instead?