Security Architecture

A logistics start-up is rebuilding its order processing platform as a set of small services deployed independently to a Kubernetes cluster. Each service has its own database, owns one bounded context, and communicates with peers over authenticated REST and gRPC. The chief information security officer is briefing the board on how this microservices model changes the firm's security posture compared with the previous single Java monolith. Which statement best captures a distinctive security implication of moving to microservices rather than retaining the monolith?

• AThe microservices design eliminates the need for network segmentation because each service runs in its own container and is therefore isolated from peers by default at the operating system level.
• BPatching cycles can be relaxed because each microservice is small enough that a compromise is contained within that service's container and cannot affect data owned by other services in the platform.
• CCentralised audit logging becomes simpler because every microservice writes to the same application log file and the team can rely on a single chain of custody across the whole order processing workflow.
• DThe east-west attack surface grows because authentication, authorisation, and transport security must now be enforced on every inter-service call instead of relying on a single process boundary, which usually requires mutual TLS, service identities, and per-service policy.check_circle Correct

Why A is wrong: Container runtimes share a host kernel and a flat pod network unless deliberate network policies, service meshes, or namespaces enforce segmentation; assuming default isolation is a common misconception that leaves east-west traffic wide open.

Why B is wrong: A compromised service is often a stepping stone to peers via service tokens, shared secrets, or excessive RBAC; smaller blast radius is a goal, not an automatic property, and patching cadence must in fact rise because each service brings its own dependency tree.

Why C is wrong: Microservices typically emit logs from many pods to a shared pipeline, so achieving an end-to-end audit trail requires correlation IDs, distributed tracing, and centralised log aggregation; assuming a single log file is exactly the legacy mindset that microservice adoption breaks.

Why D is correct: Splitting a monolith into independently deployable services replaces in-process calls with network calls, so each hop must be authenticated, authorised, and encrypted; defenders typically introduce a service mesh, workload identities, and per-service policy to control the expanded east-west attack surface.

A fintech start-up is migrating a monolithic loan calculator from a single on-premises virtual machine to a public cloud provider's function-as-a-service platform, with each pricing call handled by a short-lived function invoked from an API gateway. The chief information security officer asks the architect to identify the most significant security implication of this serverless model that did not apply to the previous design. Which statement best captures the change the team must address before go-live?

• AThe team must now manage the underlying operating system patch cadence for each function host because the cloud provider does not patch the runtime fabric used by serverless workloads.
• BThe team loses the ability to log invocations, since function-as-a-service platforms do not expose execution telemetry to customers and rely solely on provider-side monitoring for forensic purposes.
• CNetwork segmentation becomes impossible because functions always run in a shared internet-facing namespace and cannot be attached to private subnets or restricted to internal endpoints.
• DThe attack surface shifts toward function permissions, event sources, and third-party libraries pulled at build time, so over-privileged execution roles and untrusted package supply chains become the dominant risks rather than host hardening.check_circle Correct

Why A is wrong: Tempting because candidates remember patching as a shared responsibility item, but in function-as-a-service the provider owns the operating system and runtime patching; the customer is responsible for code, dependencies, and configuration only.

Why B is wrong: Plausible to a candidate who has never used a serverless platform, but every mainstream provider emits per-invocation logs, metrics, and traces that customers can route to their own SIEM; loss of telemetry is not the issue.

Why C is wrong: Tempting because early serverless platforms had limited networking, but modern offerings allow functions to be attached to private virtual networks and reach internal endpoints; segmentation is achievable, so this is not the dominant change.

Why D is correct: Correct because serverless removes host-level controls from the customer and exposes function identity, trigger configuration, and the dependency graph as the primary attack surface; that is the substantive change the team must address.

A mid-sized retailer is rebuilding its payment processing path so that the merchant systems never store full primary account numbers after authorisation. The chief information security officer wants the replacement value to be unusable to an attacker who breaches the merchant database, yet still let the merchant call the payment processor to issue refunds and recurring charges against the original card. Which data protection technique most directly meets these goals?

• AEncrypting the primary account number column with AES-256 using a key held in the merchant application's configuration file.
• BStoring the primary account number with all but the last four digits replaced by static asterisks before writing to the database.
• CReplacing the primary account number in the merchant database with a tokenised reference issued by the payment processor's token vault.check_circle Correct
• DHashing the primary account number with SHA-256 and a per-record salt before storing it in the merchant database.

Why A is wrong: Column encryption protects data at rest, but if the key sits with the application then an attacker who breaches the merchant environment is likely to obtain both the ciphertext and the key, so the card data is not meaningfully protected against the stated threat.

Why B is wrong: This is data masking, which hides the value when displayed but, if applied as the only stored form, also destroys the information needed by the processor to refund or recharge the original card, so it does not meet the operational requirement.

Why C is correct: Tokenisation substitutes the sensitive value with a non-sensitive surrogate that has no mathematical relationship to the original; only the processor's vault can map it back, so a database breach yields tokens that cannot be used to reconstruct the card, while refunds and recurring charges still work through the processor.

Why D is wrong: Hashing is a one-way transformation, so the merchant would lose the ability to refund or recharge the original card through the processor, and PANs have a small enough keyspace that targeted hash searches remain feasible.