SY0-701 Security Architecture — 10 Questions

Question 1

A company is redesigning its network to host a public-facing web application that accesses a confidential database. The security team needs to minimize the risk of a direct attack against the database server while still allowing the web server to retrieve and update data. Which network architecture best achieves this objective?

Accepted Answer

Place the web server in the DMZ and the database server on the internal network. Configure the firewall to allow inbound traffic from the web server to the database server on the required port only.. Option B is correct because it implements a tiered network architecture where the web server resides in the DMZ (a semi-trusted zone) and the database server is placed on the internal network, isolated from direct internet access. The firewall is configured with a stateful rule that permits only the web server's IP and the specific database port (e.g., TCP 3306 for MySQL or 1433 for MSSQL), preventing any direct inbound connections from the internet to the database. This minimizes the attack surface by ensuring that even if the web server is compromised, the database is not directly reachable from external hosts.

Answer

Place both the web server and the database server in the same DMZ segment and rely on host-based firewalls for protection.

Answer

Connect both servers to a single internal VLAN and use a reverse proxy to forward external traffic to the web server.

Answer

Use a site-to-site VPN to connect the web server and database server, and place both behind a single NAT gateway.

Question 2

A security architect is designing a new data center network that will host public-facing web servers and internal application servers handling confidential employee data. The architect places the web servers in a DMZ and the internal application servers on a separate internal network segment. A stateful firewall is configured to allow inbound HTTP/HTTPS traffic from the internet to the web servers only. The firewall also permits only the web servers to initiate outbound connections to the internal application servers on a specific TCP port, and all such traffic is encrypted using TLS. Which security architecture principle is this design primarily intended to enforce?

Accepted Answer

Defense in depth. The design enforces defense in depth by layering multiple security controls: a DMZ isolates public-facing web servers from internal networks, a stateful firewall restricts inbound traffic to HTTP/HTTPS only, and outbound connections from web servers to internal application servers are limited to a specific TCP port with TLS encryption. This layered approach ensures that even if one control fails (e.g., a web server is compromised), the attacker still faces additional barriers to reach sensitive internal systems.

Answer

Least privilege

Answer

Separation of duties

Answer

Zero trust

Question 3

A company's current remote access solution uses a traditional VPN that grants users full network-layer access to the internal LAN once authenticated. The security architect wants to adopt a zero trust architecture to reduce the risk of lateral movement by compromised endpoints. Which of the following implementations best aligns with zero trust principles?

Accepted Answer

Use a software-defined perimeter that authenticates each user and device before granting access only to specific applications.. Option C is correct because a software-defined perimeter (SDP) implements zero trust by authenticating both the user and device before granting access to specific applications, not the entire network. This prevents lateral movement by ensuring that even after authentication, the endpoint can only reach the allowed application, not the full LAN. This aligns with the zero trust principle of 'never trust, always verify' and micro-segmentation.

Answer

Implement a next-generation firewall and require all remote traffic to pass through it with strict rules.

Answer

Deploy a secure web gateway and require all remote users to browse through a proxy.

Answer

Enable multi-factor authentication for VPN and implement a VPN concentrator with split tunneling.

Question 4

A security architect is designing a solution to process highly sensitive financial transactions in a shared cloud environment. The architect needs to ensure that the processor and memory used to handle transaction data are isolated from the host operating system and other virtual machines, even if the hypervisor is compromised. Which technology is specifically designed to provide this level of isolation for code and data during runtime?

Accepted Answer

Secure enclave (e.g., Intel SGX). Secure enclave technology, such as Intel SGX, provides hardware-enforced isolation by creating trusted execution environments (TEEs) within the CPU. Code and data inside an enclave are encrypted in memory and decrypted only within the processor, ensuring that even a compromised hypervisor or host OS cannot access the transaction data during runtime. This meets the requirement for processor and memory isolation in a shared cloud environment.

Answer

Trusted Platform Module (TPM)

Answer

Hardware Security Module (HSM)

Answer

UEFI Secure Boot

Question 5

A security architect is redesigning remote administration for a set of critical Linux servers in a private cloud. Currently, system administrators connect directly from their corporate laptops to the servers over the internet using SSH. The architect's primary goal is to eliminate direct inbound SSH connections from the internet while still allowing authorized administrators to perform maintenance tasks. Which of the following architectural changes would best achieve this objective?

Accepted Answer

Deploy a jump server (bastion host) in a management subnet and require all administrative SSH connections to originate from the jump server, with the jump server accessible only via the corporate VPN.. Option B is correct because it eliminates direct inbound SSH from the internet by placing a jump server (bastion host) in a management subnet that is only accessible via the corporate VPN. Administrators must first connect to the VPN, then SSH to the jump server, and from there initiate SSH sessions to the target Linux servers. This architecture ensures no SSH port is exposed to the public internet, meeting the primary security goal.

Answer

Deploy a VPN concentrator and require all administrators to connect to the VPN before initiating SSH sessions directly to the servers.

Answer

Replace SSH with a web-based console proxy that uses HTTPS and multi-factor authentication, and allow direct internet access to the console proxy on port 443.

Answer

Configure each Linux server with a public IP address but restrict inbound SSH to the known public IP addresses of the administrators' corporate laptops.

Question 6

A security architect is designing the network security for a web application hosted in a public cloud environment such as AWS. The application uses an Application Load Balancer (ALB) that distributes traffic to a fleet of web servers. The web servers must only accept traffic from the ALB, and all other inbound traffic must be blocked. The ALB itself needs to accept HTTP/HTTPS traffic from anywhere on the internet. Which of the following cloud security controls should the architect configure on the web servers' network interface to best meet this requirement, assuming the cloud provider offers both stateful and stateless network filtering options?

Accepted Answer

A stateful security group that allows inbound traffic from the ALB's security group only.. Option B is correct because a stateful security group in AWS can reference another security group as a source, allowing inbound traffic only from instances associated with the ALB's security group. This ensures that web servers accept traffic exclusively from the ALB, while the ALB itself can accept HTTP/HTTPS from the internet via its own security group rules. Stateful filtering automatically allows return traffic, simplifying rule management and meeting the requirement precisely.

Answer

A stateless network ACL that allows inbound traffic from the ALB's subnet only.

Answer

A web application firewall (WAF) that inspects all traffic for SQL injection.

Answer

A host-based firewall on each web server that allows traffic from the ALB's private IP address.

Question 7

A security architect at a retail company is deploying a new e-commerce platform that processes credit card payments. The architect needs to minimize the scope of the PCI DSS assessment. The platform consists of a web server, an application server, and a database server. The cardholder data (credit card numbers) will be processed and stored only on the database server. Which of the following network architecture designs would best reduce the PCI DSS scope?

Accepted Answer

Place the database server in a separate, isolated network segment with a dedicated firewall that blocks all traffic except from the application server on the required port.. Option B is correct because isolating the database server in a separate network segment with a dedicated firewall that restricts traffic to only the application server on the required port creates a clear network segmentation boundary. This segmentation limits the cardholder data environment (CDE) to just the database server, thereby minimizing the scope of the PCI DSS assessment by excluding the web and application servers from the CDE.

Answer

Place all servers in the same VLAN and apply a host-based firewall on the database server.

Answer

Encrypt all data in transit using TLS and at rest using AES-256.

Answer

Implement network intrusion detection systems on all network segments.

Question 8

A security architect is designing a solution to securely store sensitive customer data in a cloud object storage service. The architect's primary concern is that if the storage bucket is accidentally configured as publicly accessible, the data should still be protected from unauthorized viewing. Which of the following architectural designs provides the strongest defense in depth to meet this concern?

Accepted Answer

Use client-side encryption with a customer-managed key stored in a hardware security module (HSM) and restrict access with IAM roles.. Option B is correct because client-side encryption ensures data is encrypted before it ever leaves the client, so even if the bucket is accidentally made publicly accessible, the ciphertext remains unreadable without the customer-managed key stored in the HSM. This provides defense in depth by combining encryption at the application layer with IAM role restrictions, which control access at the AWS API level. Server-side encryption alone (as in the other options) only protects data at rest on the server side, leaving it vulnerable if the bucket policy or ACLs are misconfigured to allow public read access.

Answer

Use server-side encryption with a cloud-managed key (SSE-S3) and restrict access with bucket policies.

Answer

Use default encryption with a cloud-managed key (SSE-S3) and enable bucket logging.

Answer

Use server-side encryption with a customer-provided key (SSE-C) and require MFA for delete operations on the bucket.

Question 9

A security architect is redesigning the network for a payment card processing environment. The goal is to create a cardholder data environment (CDE) that is isolated from the rest of the corporate network to reduce PCI DSS scope. The CDE will contain only the payment application servers and the database storing credit card numbers. The architect must allow authorized administrators in the corporate network to perform updates and monitoring on the CDE servers. Which of the following network architecture designs provides the strongest isolation while still meeting the requirement for authorized administrative access?

Accepted Answer

Deploy a dedicated firewall that connects the corporate network to an isolated CDE segment. Configure firewall rules to allow only SSH and RDP from a specific jump box in the corporate network to the CDE servers, and deny all other inbound traffic from the corporate network.. Option B is correct because it uses a dedicated firewall to create a true network isolation boundary between the corporate network and the CDE, which is a core PCI DSS requirement for reducing scope. By allowing only SSH and RDP from a specific jump box, it enforces strict least-privilege administrative access while preventing any direct or uncontrolled traffic from the corporate network. This design ensures that the CDE is a separate, protected segment with a single controlled entry point, meeting both isolation and authorized access needs.

Answer

Place the CDE servers on a separate subnet within the same VLAN as the corporate network, and rely on host-based firewalls on each server to deny all traffic except from specific administrative IP addresses.

Answer

Place the CDE servers on a separate VLAN with a Layer 3 switch that uses ACLs to allow only ICMP traffic from the corporate network to the CDE for monitoring, and require administrators to physically connect to the CDE network via a dedicated console server.

Answer

Connect the CDE servers directly to the internet through a web application firewall (WAF), and require all management access to occur through a cloud-based VPN with two-factor authentication.

Question 10

A security architect is designing the wireless network for a new branch office. The branch will have two types of users: employees who need access to internal corporate resources, and guests who need internet-only access. The architect plans to use WPA3-Enterprise for the employee SSID and WPA3-SAE for the guest SSID. Which of the following additional configurations is MOST critical to prevent guests from accessing internal corporate resources?

Accepted Answer

Place the guest wireless network on a separate VLAN with a firewall rule blocking inbound traffic to the corporate VLAN.. The most critical configuration is to isolate the guest network from the corporate network. Placing the guest SSID on a separate VLAN and implementing a firewall rule that blocks inbound traffic from the guest VLAN to the corporate VLAN ensures that even if a guest device is compromised or malicious, it cannot initiate connections to internal corporate resources. This leverages network segmentation and access control lists (ACLs) to enforce the principle of least privilege.

Answer

Implement MAC address filtering on the guest SSID to allow only authorized guest devices.

Answer

Disable SSID broadcast for the guest network to make it less discoverable.

Answer

Require guests to accept a captive portal agreement before gaining internet access.