SY0-701 Security Architecture — 50 Questions

Question 1

A company is redesigning its network to host a public-facing web application that accesses a confidential database. The security team needs to minimize the risk of a direct attack against the database server while still allowing the web server to retrieve and update data. Which network architecture best achieves this objective?

Accepted Answer

Place the web server in the DMZ and the database server on the internal network. Configure the firewall to allow inbound traffic from the web server to the database server on the required port only.. Option B is correct because it implements a tiered network architecture where the web server resides in the DMZ (a semi-trusted zone) and the database server is placed on the internal network, isolated from direct internet access. The firewall is configured with a stateful rule that permits only the web server's IP and the specific database port (e.g., TCP 3306 for MySQL or 1433 for MSSQL), preventing any direct inbound connections from the internet to the database. This minimizes the attack surface by ensuring that even if the web server is compromised, the database is not directly reachable from external hosts.

Answer

Place both the web server and the database server in the same DMZ segment and rely on host-based firewalls for protection.

Answer

Connect both servers to a single internal VLAN and use a reverse proxy to forward external traffic to the web server.

Answer

Use a site-to-site VPN to connect the web server and database server, and place both behind a single NAT gateway.

Question 2

A security architect is designing a new data center network that will host public-facing web servers and internal application servers handling confidential employee data. The architect places the web servers in a DMZ and the internal application servers on a separate internal network segment. A stateful firewall is configured to allow inbound HTTP/HTTPS traffic from the internet to the web servers only. The firewall also permits only the web servers to initiate outbound connections to the internal application servers on a specific TCP port, and all such traffic is encrypted using TLS. Which security architecture principle is this design primarily intended to enforce?

Accepted Answer

Defense in depth. The design enforces defense in depth by layering multiple security controls: a DMZ isolates public-facing web servers from internal networks, a stateful firewall restricts inbound traffic to HTTP/HTTPS only, and outbound connections from web servers to internal application servers are limited to a specific TCP port with TLS encryption. This layered approach ensures that even if one control fails (e.g., a web server is compromised), the attacker still faces additional barriers to reach sensitive internal systems.

Answer

Least privilege

Answer

Separation of duties

Answer

Zero trust

Question 3

A company's current remote access solution uses a traditional VPN that grants users full network-layer access to the internal LAN once authenticated. The security architect wants to adopt a zero trust architecture to reduce the risk of lateral movement by compromised endpoints. Which of the following implementations best aligns with zero trust principles?

Accepted Answer

Use a software-defined perimeter that authenticates each user and device before granting access only to specific applications.. Option C is correct because a software-defined perimeter (SDP) implements zero trust by authenticating both the user and device before granting access to specific applications, not the entire network. This prevents lateral movement by ensuring that even after authentication, the endpoint can only reach the allowed application, not the full LAN. This aligns with the zero trust principle of 'never trust, always verify' and micro-segmentation.

Answer

Implement a next-generation firewall and require all remote traffic to pass through it with strict rules.

Answer

Deploy a secure web gateway and require all remote users to browse through a proxy.

Answer

Enable multi-factor authentication for VPN and implement a VPN concentrator with split tunneling.

Question 4

A security architect is designing a solution to process highly sensitive financial transactions in a shared cloud environment. The architect needs to ensure that the processor and memory used to handle transaction data are isolated from the host operating system and other virtual machines, even if the hypervisor is compromised. Which technology is specifically designed to provide this level of isolation for code and data during runtime?

Accepted Answer

Secure enclave (e.g., Intel SGX). Secure enclave technology, such as Intel SGX, provides hardware-enforced isolation by creating trusted execution environments (TEEs) within the CPU. Code and data inside an enclave are encrypted in memory and decrypted only within the processor, ensuring that even a compromised hypervisor or host OS cannot access the transaction data during runtime. This meets the requirement for processor and memory isolation in a shared cloud environment.

Answer

Trusted Platform Module (TPM)

Answer

Hardware Security Module (HSM)

Answer

UEFI Secure Boot

Question 5

A security architect is redesigning remote administration for a set of critical Linux servers in a private cloud. Currently, system administrators connect directly from their corporate laptops to the servers over the internet using SSH. The architect's primary goal is to eliminate direct inbound SSH connections from the internet while still allowing authorized administrators to perform maintenance tasks. Which of the following architectural changes would best achieve this objective?

Accepted Answer

Deploy a jump server (bastion host) in a management subnet and require all administrative SSH connections to originate from the jump server, with the jump server accessible only via the corporate VPN.. Option B is correct because it eliminates direct inbound SSH from the internet by placing a jump server (bastion host) in a management subnet that is only accessible via the corporate VPN. Administrators must first connect to the VPN, then SSH to the jump server, and from there initiate SSH sessions to the target Linux servers. This architecture ensures no SSH port is exposed to the public internet, meeting the primary security goal.

Answer

Deploy a VPN concentrator and require all administrators to connect to the VPN before initiating SSH sessions directly to the servers.

Answer

Replace SSH with a web-based console proxy that uses HTTPS and multi-factor authentication, and allow direct internet access to the console proxy on port 443.

Answer

Configure each Linux server with a public IP address but restrict inbound SSH to the known public IP addresses of the administrators' corporate laptops.

Question 6

A security architect is designing the network security for a web application hosted in a public cloud environment such as AWS. The application uses an Application Load Balancer (ALB) that distributes traffic to a fleet of web servers. The web servers must only accept traffic from the ALB, and all other inbound traffic must be blocked. The ALB itself needs to accept HTTP/HTTPS traffic from anywhere on the internet. Which of the following cloud security controls should the architect configure on the web servers' network interface to best meet this requirement, assuming the cloud provider offers both stateful and stateless network filtering options?

Accepted Answer

A stateful security group that allows inbound traffic from the ALB's security group only.. Option B is correct because a stateful security group in AWS can reference another security group as a source, allowing inbound traffic only from instances associated with the ALB's security group. This ensures that web servers accept traffic exclusively from the ALB, while the ALB itself can accept HTTP/HTTPS from the internet via its own security group rules. Stateful filtering automatically allows return traffic, simplifying rule management and meeting the requirement precisely.

Answer

A stateless network ACL that allows inbound traffic from the ALB's subnet only.

Answer

A web application firewall (WAF) that inspects all traffic for SQL injection.

Answer

A host-based firewall on each web server that allows traffic from the ALB's private IP address.

Question 7

A security architect at a retail company is deploying a new e-commerce platform that processes credit card payments. The architect needs to minimize the scope of the PCI DSS assessment. The platform consists of a web server, an application server, and a database server. The cardholder data (credit card numbers) will be processed and stored only on the database server. Which of the following network architecture designs would best reduce the PCI DSS scope?

Accepted Answer

Place the database server in a separate, isolated network segment with a dedicated firewall that blocks all traffic except from the application server on the required port.. Option B is correct because isolating the database server in a separate network segment with a dedicated firewall that restricts traffic to only the application server on the required port creates a clear network segmentation boundary. This segmentation limits the cardholder data environment (CDE) to just the database server, thereby minimizing the scope of the PCI DSS assessment by excluding the web and application servers from the CDE.

Answer

Place all servers in the same VLAN and apply a host-based firewall on the database server.

Answer

Encrypt all data in transit using TLS and at rest using AES-256.

Answer

Implement network intrusion detection systems on all network segments.

Question 8

A security architect is designing a solution to securely store sensitive customer data in a cloud object storage service. The architect's primary concern is that if the storage bucket is accidentally configured as publicly accessible, the data should still be protected from unauthorized viewing. Which of the following architectural designs provides the strongest defense in depth to meet this concern?

Accepted Answer

Use client-side encryption with a customer-managed key stored in a hardware security module (HSM) and restrict access with IAM roles.. Option B is correct because client-side encryption ensures data is encrypted before it ever leaves the client, so even if the bucket is accidentally made publicly accessible, the ciphertext remains unreadable without the customer-managed key stored in the HSM. This provides defense in depth by combining encryption at the application layer with IAM role restrictions, which control access at the AWS API level. Server-side encryption alone (as in the other options) only protects data at rest on the server side, leaving it vulnerable if the bucket policy or ACLs are misconfigured to allow public read access.

Answer

Use server-side encryption with a cloud-managed key (SSE-S3) and restrict access with bucket policies.

Answer

Use default encryption with a cloud-managed key (SSE-S3) and enable bucket logging.

Answer

Use server-side encryption with a customer-provided key (SSE-C) and require MFA for delete operations on the bucket.

Question 9

A security architect is redesigning the network for a payment card processing environment. The goal is to create a cardholder data environment (CDE) that is isolated from the rest of the corporate network to reduce PCI DSS scope. The CDE will contain only the payment application servers and the database storing credit card numbers. The architect must allow authorized administrators in the corporate network to perform updates and monitoring on the CDE servers. Which of the following network architecture designs provides the strongest isolation while still meeting the requirement for authorized administrative access?

Accepted Answer

Deploy a dedicated firewall that connects the corporate network to an isolated CDE segment. Configure firewall rules to allow only SSH and RDP from a specific jump box in the corporate network to the CDE servers, and deny all other inbound traffic from the corporate network.. Option B is correct because it uses a dedicated firewall to create a true network isolation boundary between the corporate network and the CDE, which is a core PCI DSS requirement for reducing scope. By allowing only SSH and RDP from a specific jump box, it enforces strict least-privilege administrative access while preventing any direct or uncontrolled traffic from the corporate network. This design ensures that the CDE is a separate, protected segment with a single controlled entry point, meeting both isolation and authorized access needs.

Answer

Place the CDE servers on a separate subnet within the same VLAN as the corporate network, and rely on host-based firewalls on each server to deny all traffic except from specific administrative IP addresses.

Answer

Place the CDE servers on a separate VLAN with a Layer 3 switch that uses ACLs to allow only ICMP traffic from the corporate network to the CDE for monitoring, and require administrators to physically connect to the CDE network via a dedicated console server.

Answer

Connect the CDE servers directly to the internet through a web application firewall (WAF), and require all management access to occur through a cloud-based VPN with two-factor authentication.

Question 10

A security architect is designing the wireless network for a new branch office. The branch will have two types of users: employees who need access to internal corporate resources, and guests who need internet-only access. The architect plans to use WPA3-Enterprise for the employee SSID and WPA3-SAE for the guest SSID. Which of the following additional configurations is MOST critical to prevent guests from accessing internal corporate resources?

Accepted Answer

Place the guest wireless network on a separate VLAN with a firewall rule blocking inbound traffic to the corporate VLAN.. The most critical configuration is to isolate the guest network from the corporate network. Placing the guest SSID on a separate VLAN and implementing a firewall rule that blocks inbound traffic from the guest VLAN to the corporate VLAN ensures that even if a guest device is compromised or malicious, it cannot initiate connections to internal corporate resources. This leverages network segmentation and access control lists (ACLs) to enforce the principle of least privilege.

Answer

Implement MAC address filtering on the guest SSID to allow only authorized guest devices.

Answer

Disable SSID broadcast for the guest network to make it less discoverable.

Answer

Require guests to accept a captive portal agreement before gaining internet access.

Question 11

A security operations center (SOC) analyst is overwhelmed by the volume of alerts. The management wants to implement a solution that can automatically respond to common threats, such as blocking an IP address or isolating a compromised endpoint, without requiring human intervention. Which of the following technologies best meets this requirement?

Accepted Answer

Security Orchestration, Automation, and Response (SOAR). SOAR is the correct choice because it is specifically designed to automate response actions to common security incidents, such as blocking an IP address via firewall APIs or isolating an endpoint through EDR integration, without requiring human intervention. This directly addresses the SOC analyst's alert fatigue by enabling playbook-driven, automated remediation.

Answer

Security Information and Event Management (SIEM)

Answer

Endpoint Detection and Response (EDR)

Answer

Cloud Access Security Broker (CASB)

Question 12

A company is implementing network segmentation to isolate the guest wireless network from the internal corporate network. Which of the following technologies is most appropriate to enforce this separation at Layer 2?

Accepted Answer

VLANs. VLANs (Virtual Local Area Networks) are the correct technology because they operate at Layer 2 (Data Link layer) of the OSI model, allowing network administrators to logically segment a physical switch into multiple isolated broadcast domains. By assigning the guest wireless network to a separate VLAN (e.g., VLAN 100) and the internal corporate network to another (e.g., VLAN 10), traffic between them is blocked at Layer 2 unless explicitly routed through a Layer 3 device with appropriate firewall rules. This directly enforces separation without requiring additional hardware, making VLANs the most appropriate and efficient choice for isolating guest traffic at Layer 2.

Answer

ACLs

Answer

DMZ

Answer

VPN

Question 13

Based on the exhibit, which change best reduces the blast radius if a user workstation is compromised?

Accepted Answer

Remove direct user access to the backup VLAN and allow only the dedicated backup path.. Option C is correct because removing direct user access to the backup VLAN and allowing only the dedicated backup path enforces network segmentation, which limits lateral movement. If a workstation in VLAN 10 is compromised, an attacker cannot pivot directly to the backup server in VLAN 30, reducing the blast radius. This aligns with the principle of least privilege and defense-in-depth for backup infrastructure.

Answer

Add more allow rules from VLAN 10 to VLAN 30 for SMB and RDP so restore jobs stay flexible.

Answer

Move the backup server into the user VLAN to avoid routing and ACL complexity.

Answer

Increase the DHCP lease time so backup jobs run less often during business hours.

Question 14

Based on the exhibit, which change should be made first to secure remote administration of the network device?

Accepted Answer

Disable Telnet and allow SSHv2 only for remote administration.. Telnet transmits all data, including credentials, in cleartext, making it vulnerable to interception. SSHv2 provides encrypted remote administration and is the secure replacement for Telnet. Disabling Telnet and enabling only SSHv2 is the immediate and necessary first step to secure remote device management.

Answer

Enable FTP so administrators can upload and download configuration files securely.

Answer

Open the management interface to any internet host as long as the password is complex.

Answer

Use one shared local administrator account for all network engineers.

Question 15

Administrators need to manage internal switches from home. Management traffic must be encrypted, MFA must be used, and no switch management interface should be exposed directly to the internet. Which design is best?

Accepted Answer

Use a VPN into the internal network, then administer the switches through a hardened jump host over SSH.. Option B is correct because it uses a VPN to create an encrypted tunnel from the home user to the internal network, then requires SSH (which encrypts management traffic) through a hardened jump host. This design ensures MFA can be enforced at the VPN or jump host layer, and no switch management interface is directly exposed to the internet, satisfying all three requirements.

Answer

Open SSH directly to each switch on a public IP address and restrict access by source IP only.

Answer

Allow HTTPS management to each switch over the internet because the channel is encrypted.

Answer

Use Telnet inside the office and route home users through a split-tunnel VPN.

Question 16

Field staff use company-owned tablets that also run approved personal apps. Security needs business data isolated from personal data, the ability to wipe only corporate content, and enforcement of screen lock and encryption. Which two controls best fit? Select two.

Accepted Answer

Enroll the tablets in MDM and enforce encryption and a screen-lock PIN.. Option A is correct because Mobile Device Management (MDM) enforces security policies like encryption and screen-lock PIN across the device, meeting the requirements for data protection. Option B is correct because a managed work profile or container (e.g., Android Work Profile or iOS Managed Open In) isolates corporate apps and data from personal apps, allowing selective wipe of corporate content without affecting personal data.

Answer

Allow rooted devices if the antivirus app is current.

Answer

Place all apps in one shared profile and use a single passcode for every user.

Answer

Disable remote wipe so personal photos are never affected.

Question 17

A manufacturing company is redesigning its plant network. PLCs must communicate with a SCADA server for telemetry, but neither the PLCs nor the SCADA server should be reachable from employee laptops or the internet. Which architecture best meets the requirement?

Accepted Answer

Create a separate OT zone behind a firewall with explicit allow rules only to the SCADA server.. Option B is correct because it creates an isolated OT (Operational Technology) zone using a firewall, which enforces segmentation between the industrial control systems (PLCs and SCADA) and the corporate IT network. By placing the SCADA server and PLCs behind a firewall with explicit allow rules only for necessary SCADA-to-PLC telemetry, the architecture ensures that employee laptops and the internet cannot reach these devices, meeting the requirement for no reachability from those sources.

Answer

Place the PLCs and office workstations on the same VLAN and rely on endpoint antivirus.

Answer

Publish the SCADA server through a public reverse proxy so vendors can reach it remotely.

Answer

Put the PLCs on the same subnet as user devices and hide them behind NAT.

Question 18

A supplier portal is browser-based and used by external partner companies. Each partner already has its own identity provider. The portal must trust assertions from those IdPs and avoid creating separate local passwords for each partner. Which integration is best?

Accepted Answer

Use SAML 2.0 federation with trust relationships to the partner identity providers.. SAML 2.0 federation is the correct choice because it enables the supplier portal to trust assertions from multiple external identity providers (IdPs) without creating local passwords. SAML uses XML-based tokens signed by the partner's IdP, allowing the portal to accept authentication claims via a trust relationship, which directly meets the requirement of avoiding separate local credentials for each partner.

Answer

Use LDAP directory synchronization for all partner users.

Answer

Use NTLM pass-through authentication to each partner account.

Answer

Use PAP over TLS so the portal can collect partner passwords securely.

Question 19

A team hosts a confidential document repository on an IaaS virtual machine. The provider secures the datacenter, hardware, and hypervisor. The organization wants to control who can decrypt the files and be able to revoke that access without changing providers. Which control is best?

Accepted Answer

Use customer-managed encryption keys in the cloud KMS or HSM.. Customer-managed encryption keys (CMEK) in a cloud KMS or HSM allow the organization to retain control over key material, enabling them to decrypt files and revoke access independently of the cloud provider. This meets the requirement to control decryption and revocation without changing providers, as the provider cannot access the keys. In contrast, provider-managed keys do not offer the same level of tenant-controlled revocation.

Answer

Use the provider's default managed encryption keys for the storage service.

Answer

Rely on security groups and network ACLs to protect the document contents.

Answer

Enable automated snapshots so deleted files can be restored later.

Question 20

An online retailer is redesigning its public web application so the web server can receive internet traffic, the application server can only be reached by the web tier, and the database server can only be reached by the application tier. Which placement best supports this design?

Accepted Answer

Put the web server in a public zone, the application server in a private zone, and the database server in an isolated internal zone.. Option B is correct because it implements a classic three-tier architecture with network segmentation. The web server in a public zone (DMZ) accepts internet traffic, the application server in a private zone is isolated from direct internet access and only reachable by the web tier, and the database server in an isolated internal zone is only reachable by the application tier. This design enforces the principle of least privilege and minimizes the attack surface by using firewalls or security groups to restrict traffic between tiers.

Answer

Place all three servers on the same private subnet and control access only with strong passwords.

Answer

Put the database in the public zone so the web tier can query it directly from the internet.

Answer

Use a single reverse proxy for all three servers and disable network segmentation to simplify management.