CompTIA SY0-701 Bundle

A compatible host intrusion prevention system can examine locally observed exploit behaviors and block suspicious execution or memory-abuse patterns before they complete. The server faces exploitation that network filtering cannot stop, and no usable vendor patch exists yet, so inline host protection can provide a temporary compensating control. Deploy prevention signatures or behavior policies in a tested mode to avoid service disruption; HIPS supplements, rather than replaces, eventual software remediation.

Driver-signature enforcement blocks unsigned or untrusted kernel drivers from loading. The described threat is memory exploitation of an exposed server process, not a malicious kernel-module installation. A trusted or signed process can still contain memory-corruption vulnerabilities. Driver policies are useful hardening, but host-level exploit prevention is more directly targeted.

Untrusted-macro blocking prevents office document automation from triggering malicious code in common phishing workflows. It does not intercept arbitrary memory exploitation in the server application described. If the vulnerable process were launched by a malicious document this might be one useful defense layer, but no such document path is part of this case.

Separate finance and marketing into different security zones and implement explicit interzone policy allowing only documented business flows. The current flat subnet gives marketing hosts unnecessary network reachability to finance applications, creating a lateral movement path after endpoint compromise. Zone-level filtering is an appropriate first architectural boundary before introducing more granular per-workload controls. Validate directory, DNS and shared service dependencies so segmentation does not break legitimate cross-department functions.

An Internet-edge firewall controls traffic entering or leaving the perimeter, but it does not necessarily inspect traffic between two hosts on the same internal subnet. In this flat design, a compromised marketing workstation could still reach finance servers laterally. A broader perimeter deny rule cannot substitute for interdepartmental isolation where the risk occurs.

CPU reservations influence how virtual machine resources are scheduled and can reduce performance contention. They have no direct effect on whether marketing machines can initiate unauthorized sessions to finance application servers. The scenario is about network lateral-movement paths, not virtual machine resource starvation or noisy-neighbor behavior.

Saying IaaS supports guest operating-system control describes a deployment capability, not the patching party required by the question. The team does control its images, and that freedom is precisely why the customer must maintain guest updates. Choose the explicit assignment of responsibility rather than a general observation about the architecture.

A SaaS provider normally operates the service's physical hosting and underlying infrastructure, but the scenario is an IaaS deployment of customer-administered VMs. Discussing physical protection of a SaaS CRM does not answer who patches these guest operating systems. Product models must not be conflated when assigning security duties.

Hybrid cloud integration joins on-premises and cloud resources for a composite architecture, perhaps using secure connectivity and shared identity. Whether an organization adopts hybrid integration does not identify the party responsible for updating an IaaS VM guest. The contract expressly leaves guest administration with the customer, so its patching obligation is unchanged.

The hosted CRM is a SaaS application, so the service provider is responsible for physical datacenter safeguards such as perimeter access controls, building entry restrictions and protection of underlying facilities. The customer still manages its users, application settings and data according to the service agreement, but it does not install locks on the provider’s server rooms. Shared responsibility varies by service type, and physical infrastructure protection falls on the SaaS operator in this scenario.

Enterprise-owned physical safeguards apply when the enterprise runs its own datacenter or directly controls the relevant facilities. Here the CRM provider hosts the SaaS infrastructure in its own building. The subscribing business should assess contractual and compliance evidence, but it does not ordinarily secure that provider building itself.

Customer patching of an IaaS guest is a separate responsibility boundary that can be correct for self-managed cloud virtual machines. The question concerns physical building security at a SaaS provider. Assigning guest patching duties does not answer the facilities question and incorrectly shifts the discussion to a different service model.

Customer guest patching is a responsibility that often follows when an organization uses self-managed IaaS virtual machines. It is not itself a cloud deployment model that grants the requested operating-system configuration freedom. Patching responsibilities matter after choosing the service model; the question asks which architecture provides guest OS control.

Function as a service executes short-lived workloads in a provider-managed runtime, often triggered by events and scaled without dedicated guest OS administration. This is convenient for event handlers but generally does not give the team unrestricted control over operating-system configuration. It conflicts with the stated requirement for custom guest settings.

SaaS provider physical safeguards describe the operator’s role protecting hosted application facilities. SaaS customers typically configure application features rather than administer the underlying guest OS. The responsibility for datacenter security has no bearing on granting custom operating-system control to the application team.

A private cloud is provisioned for exclusive use by a single organization, whether it is operated internally or by a contracted provider. That deployment model fits the agency’s policy against sharing a cloud environment with other organizations and offers governance options for dedicated resources. The agency still must verify isolation and contractual control details rather than relying on a marketing label. Private does not automatically mean more secure; security depends on implementation and operations.

Standard pooled multi-tenant IaaS shares provider infrastructure among organizations through logical isolation. It may be secure and cost-efficient, but this agency has a firm requirement for a dedicated cloud environment rather than shared tenancy. Logical VM isolation does not override that explicit deployment-model constraint.

A typical SaaS subscription hosted on shared provider infrastructure gives customers limited control over underlying architecture. It also conflicts with the stated policy prohibiting an environment pooled with unrelated organizations. SaaS might suit ordinary CRM operations, but it does not meet the agency’s dedicated infrastructure-governance need.

A hybrid architecture keeps latency-sensitive plant control functions on premises while integrating them securely with elastic cloud analytics. This respects industrial real-time and safety constraints while gaining scalable processing for data analysis outside the production control loop. Separate networks, controlled gateways, telemetry buffering and identity boundaries must be designed so cloud outages do not destabilize plant control. The need to retain local controllers and use cloud services is the decisive hybrid requirement.

Function as a service can implement cloud event processing without dedicated server administration, and it might be part of the analytics system. It does not by itself describe the required architectural relationship between immovable plant controllers and cloud resources. The answer sought is the combined on-premises/cloud model, not one cloud compute implementation.

IaaS offers cloud virtual machines and guest OS administration, which can support analytics workloads requiring custom environments. It says nothing about preserving local, safety-critical controllers and connecting them to cloud data services. The case requires integration across two deployment locations, so a general IaaS capability is too narrow.

Separate guest kernels are a property of conventional virtual machines, not standard Linux containers sharing a host OS. The question explicitly states that both workloads execute through the same kernel. Treating each container as a VM would lead to an incorrect assurance that a host-kernel vulnerability cannot affect its neighbor.

Network namespaces separate interfaces, addresses and routes between containers under normal operating conditions. They cannot neutralize a vulnerability that grants execution inside the common kernel implementing those namespaces. Once an attacker compromises that privileged layer, the attacker may bypass the network boundaries and reach other containers.

A read-only container root filesystem reduces opportunities to modify application files and can hinder persistence after compromise. It does not eliminate kernel defects or prevent code from exploiting them in memory. Read-only user-space files cannot guarantee that host-kernel instructions, kernel data structures, or sibling workloads remain safe.

Virtual machines let the lab boot separate guest operating-system kernels on a hypervisor rather than sharing one host kernel among applications. That is essential when the workload itself consists of untrusted operating-system kernels and must not run with direct control of the host kernel. Hypervisor isolation still requires patching and containment for VM escape risks, but separate guest kernels provide the required execution model. Ordinary containers isolate processes, not full independent kernels.

Function as a service runs application functions in a managed provider runtime triggered by events. The customer usually cannot supply and boot arbitrary untrusted operating-system kernels in that environment. FaaS may isolate function instances, but its abstraction is not a replacement for virtualized machines in this kernel-experiment use case.

Shared-kernel exposure identifies a weakness of ordinary containers in which isolated processes rely on one host OS kernel. That is precisely what this lab wants to avoid when executing untrusted kernels. Naming the risk does not provide the separate guest-kernel execution environment that the requirements call for.

Function as a service is built for event-triggered work such as processing a newly uploaded media object, with provider-managed execution infrastructure and scale driven by incoming requests. It reduces guest OS patching and idle-server administration for a sporadic workload. The team still owns function code, dependencies, access privileges, triggers and data protection. Account for execution limits, concurrency and retry behavior, but the described operational preference aligns directly with FaaS.

Internal service-to-service controls such as mutual authentication and authorization protect communication among application components. They can be needed regardless of hosting model but do not determine automatic event-driven scaling or remove guest OS operations. This option addresses a different dimension of the application's security architecture.

Virtual machines with separate guest kernels provide strong flexibility and guest isolation, but the customer or managed operator normally handles instance lifecycle and patch responsibilities. They can run upload processors, yet a continuously provisioned VM model does not naturally satisfy minimal server administration and automatic per-event scaling as directly as FaaS.

Mutual TLS establishes an encrypted transport session in which both microservices authenticate peer identities using appropriately trusted certificates. It protects confidential east-west API traffic against passive observers and gives each endpoint cryptographic evidence of the other’s identity. Enforce authorization based on workload identity and rotate certificates securely, because mTLS alone does not decide which API operation is permitted. The case demands both encryption and bilateral authentication inside the cluster.

IP-based microsegmentation can restrict which source networks or workloads connect to particular ports, reducing lateral movement. Those flow rules do not inherently authenticate each service as a cryptographic peer or encrypt its payload. Workload IP addresses may also change during orchestration. Segmentation complements, but cannot replace, mutual TLS for both explicit requirements.

Separate container or kernel isolation boundaries can limit some classes of host compromise but do not automatically protect application messages exchanged across the cluster network. A container runtime does not by itself supply peer certificate authentication or transport encryption between microservices. The requested controls belong on the service communications path.