Exam SY0-701 topic 1 question 93 discussion

B. Non-segmented network Opening ports on a firewall for a new system introduces the risk that the new system might be deployed on a non-segmented network. This means that the new system and its traffic could potentially be exposed to other parts of the network, increasing the risk of lateral movement by an attacker if the system is compromised. Network segmentation helps in containing potential breaches and limiting access to sensitive areas of the network. Therefore, the correct answer is: B. Non-segmented network

I am thinking that opening firewall ports is a Layer 3 and Layer 4 issue and not a Layer 7 vulnerability, which is where the Vulnerable software would fit in. I would be more concerned about the Cloud provider which is why I am choosing C: Supply Chain Vendor.

C: Supply Chain Vendor.

I think zero-day vulnerability on new system can be out-of-hands Cloud Provider, so i think D will be fit anwser

C. Supply chain vendor The primary risk in this scenario is the supply chain vendor. Since the system is a SaaS offering, the security of the underlying infrastructure and applications relies heavily on the vendor's security practices. Here's a breakdown of why the other options aren't as relevant: the most significant risk in this scenario is the potential for vulnerabilities or security breaches within the SaaS provider's infrastructure or applications.

When deploying and supporting a system provided by a SaaS (Software as a Service) vendor, the supply chain vendor risk becomes a primary concern. The organization is relying on the SaaS provider for security, availability, and compliance. Risks include: The SaaS provider's systems being compromised. Lack of transparency in the vendor’s security measures. Potential vulnerabilities in the SaaS platform affecting the organization. These risks emphasize the importance of vendor assessments, contractual security requirements, and regular audits

you are opening firewall for a third party, ie allowing a third party into your network bringing all their vulnerabilities along for the ride. Supply chain vendor by definition

B. Non-segmented network GPT

Supply chain vendor

I think C is the best choice because, since SaaS solutions are often integrated with core business functions and handle sensitive data, any vulnerabilities, breaches, or lapses in security at the vendor's end can directly impact the organization. This is a key concern in modern enterprise environments, where trust in third-party providers must be carefully managed through security assessments, vendor reviews, and contractual security requirements.

It's C for me. Supply Chain vendor deals with the management of service providers and tampering with underlying infrastructure, which is what the question is asking.

I'll say C. This deals with Third Party Risk Management. The third party is the Saas provider and that provider can access the network through those open ports adding their own malicious code.

Since this specifies that it wants a risk *in the new system,* B&C are definitely not in the new system (B is an existing network, supply chain should already be analyzed). This leaves A&D. Since it's talking about opening ports in a firewall and potentially exposing this new system, it wants D, Vulnerable Software.

This is a really terrible question. It could possibly be A because the software on the new system, with ports now being opened to the internet, might have a default username/password that an attacker could exploit. But that would then mean that the software is vulnerable to those attacks to begin with.

Given that the question specifically says "which is a risk in *the new system*" I would say that it can NOT be A or B because those are not risks with the provided system, they are risks with the corporate network in which the system is being deployed. It's a crapshoot between C & D depending on whoever wrote this vague question and decided what they wanted the answer to be. I would hazard to say D, because it most specifically relates to the system itself, and thus also the firewall ports that it will be whitelisted to communicate on.

C. Supply chain vendor

B. Non-segmented network