SY0-601 Architecture & Design 3

Question 1

A developer stores secrets such as API keys and database passwords directly in application configuration files checked into source control. Which secure design practice should be enforced instead?

Accepted Answer

Use environment variables or a secrets management vault

Answer

Secrets should be stored in a dedicated secrets manager or injected via environment variables, never hardcoded in source-controlled files.

Question 2

Which software development concept involves running an application with only the permissions it needs to perform its function and no more?

Accepted Answer

Principle of least privilege

Answer

The principle of least privilege limits an application's permissions to the minimum required, reducing the blast radius if the application is compromised.

Question 3

A company's serverless functions are triggered by events and execute in ephemeral containers. Which cloud security concept describes ensuring these workloads are protected even though they have no persistent OS to harden?

Accepted Answer

Serverless security / function-level isolation

Answer

Serverless security focuses on securing function code, permissions, and event sources rather than the underlying OS, which is managed by the provider.

Question 4

An organization uses containers for its microservices. A security review finds that all containers run as root. Which remediation BEST reduces risk?

Accepted Answer

Run containers with a non-root user and read-only filesystem

Answer

Running containers as non-root with a read-only filesystem limits the damage an attacker can do if they exploit a vulnerability inside the container.

Question 5

A security engineer recommends enabling Secure Boot on all enterprise endpoints. What threat does Secure Boot primarily mitigate?

Accepted Answer

Bootkit and rootkit infections that persist below the OS

Answer

Secure Boot uses cryptographic signatures to verify that the bootloader and OS kernel have not been tampered with, preventing bootkits from loading before the OS.

(SY0-601) CompTIA Security+ IT Certification Practice Test

(SY0-601) CompTIA Security+ IT Certification Practice Test

SY0-601 Architecture & Design 3