SY0-701 Security Architecture — 50 Questions

Question 1

A security architect is redesigning remote administration for a set of critical Linux servers in a private cloud. Currently, system administrators connect directly from their corporate laptops to the servers over the internet using SSH. The architect's primary goal is to eliminate direct inbound SSH connections from the internet while still allowing authorized administrators to perform maintenance tasks. Which of the following architectural changes would best achieve this objective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a jump server (bastion host) in a management subnet and require all administrative SSH connections to originate from the jump server, with the jump server accessible only via the corporate VPN.. Option B is the best because it eliminates direct inbound SSH from the internet by placing a jump server (bastion host) in a management subnet that is only accessible via the corporate VPN. Administrators must first connect to the VPN, then SSH to the jump server, and from there initiate SSH sessions to the target Linux servers. This architecture ensures no SSH port is exposed to the public internet and provides a centralized control/audit point. While a VPN alone (Option A) could also remove direct internet exposure if the servers are placed behind the VPN, it does not provide the same level of administrative control and monitoring as a dedicated jump server.

Answer

Deploy a VPN concentrator and require all administrators to connect to the VPN before initiating SSH sessions directly to the servers.

Answer

Replace SSH with a web-based console proxy that uses HTTPS and multi-factor authentication, and allow direct internet access to the console proxy on port 443.

Answer

Configure each Linux server with a public IP address but restrict inbound SSH to the known public IP addresses of the administrators' corporate laptops.

Question 2

A security architect is designing a solution to securely store sensitive customer data in a cloud object storage service. The architect's primary concern is that if the storage bucket is accidentally configured as publicly accessible, the data should still be protected from unauthorized viewing. Which of the following architectural designs provides the strongest defense in depth to meet this concern?

Accepted Answer

Use client-side encryption with a customer-managed key stored in a hardware security module (HSM) and restrict access with role-based access controls.. Client-side encryption ensures data is encrypted before it leaves the client device, so even if the object storage bucket is inadvertently made publicly accessible, the stored ciphertext remains unreadable without the customer-managed encryption key held in the HSM. This provides defense in depth by combining application-layer encryption with access control restrictions at the cloud provider's management layer. Server-side encryption alone only protects data at rest on the provider's infrastructure and does not prevent an unauthorized user from accessing the decrypted data if the storage access policy is misconfigured to allow public read access.

Answer

Use server-side encryption with a cloud-managed key and restrict access with access control policies.

Answer

Use default encryption with a cloud-managed key and enable storage access logging.

Answer

Use server-side encryption with a customer-provided key and require MFA for delete operations on the stored objects.

Question 3

A manufacturing company is redesigning its plant network. PLCs must communicate with a SCADA server for telemetry, but neither the PLCs nor the SCADA server should be reachable from employee laptops or the internet. Which architecture best meets the requirement?

Accepted Answer

Create a separate OT zone behind a firewall with explicit allow rules only to the SCADA server.. It creates an isolated OT (Operational Technology) zone using a firewall, which enforces segmentation between the industrial control systems (PLCs and SCADA) and the corporate IT network. By placing the SCADA server and PLCs behind a firewall with explicit allow rules only for necessary PLC-to-SCADA telemetry, the architecture ensures that employee laptops and the internet cannot reach these devices, meeting the requirement for no reachability from those sources.

Answer

Place the PLCs and office workstations on the same VLAN and rely on endpoint antivirus.

Answer

Publish the SCADA server through a public reverse proxy so vendors can reach it remotely.

Answer

Put the PLCs on the same subnet as user devices and hide them behind NAT.

Question 4

A manufacturer wants partner-company users to access a procurement portal using their own company identities. The manufacturer does not want to create local accounts for each partner user, but it still needs to control what those users can do in the portal. Which approach should be used?

Accepted Answer

Use federated identity with role mapping so the portal trusts each partner’s identity provider.. Federated identity with role mapping allows the manufacturer to trust authentication performed by each partner's own identity provider (IdP) using standards like SAML 2.0 or OpenID Connect. This eliminates the need for local accounts while enabling fine-grained access control through roles or attributes passed in the assertion, ensuring partners can only perform authorized actions in the portal.

Answer

Create one shared partner account for each external company and reuse the same password.

Answer

Synchronize every partner user into the manufacturer’s directory and require a separate password change.

Answer

Store partner passwords in the portal database and use password reset emails for access control.

Question 5

A manufacturer wants partner-company users to access a procurement portal. The manufacturer does not want to create separate local accounts, and the partners want to authenticate their own users with existing corporate identities. Which two capabilities should be implemented? Select two.

Accepted Answer

Trust the partner identity providers through federation and accept their assertions.. Federation allows the manufacturer to trust identity assertions from the partners' own identity providers (IdPs) using standards like SAML 2.0 or OIDC. This eliminates the need for local accounts while enabling partners to authenticate with their existing corporate identities. However, authentication alone does not determine what users are allowed to do; after successful federation, the application must map partner roles or groups to application permissions. Both federation (authentication) and role mapping (authorization) are required to meet the full access control needs.

Answer

Create a separate local account for every partner employee and store the passwords internally.

Answer

Use a shared generic partner login for each company to simplify support.

Answer

Require partners to email screenshots of their credentials to request access.

Question 6

An access point connected to a switch suddenly lets guest Wi-Fi users reach an internal printer VLAN, but only on the new wiring closet. The AP uplink is configured as a trunk with dynamic negotiation enabled, native VLAN 1, and allowed VLANs 10, 20, and 30. Guest traffic should be VLAN 40 and must not transit to internal segments. Which change best fixes the issue?

Accepted Answer

Disable dynamic trunk negotiation, configure a static trunk, allow only VLANs 40 and 99, and move the native VLAN to an unused value.. Guest traffic must be isolated on VLAN 40, but the trunk's allowed VLAN list omits VLAN 40, so correctly tagged guest frames would be dropped. However, the security breach occurs because the native VLAN is set to VLAN 1, and any untagged traffic from the AP (e.g., due to a guest SSID misconfiguration or fallback) is placed into VLAN 1, which is allowed and can reach internal VLANs. By disabling DTP, configuring a static trunk, allowing only VLANs 40 and 99 (management), and changing the native VLAN to an unused value, you ensure that guest traffic is explicitly tagged as VLAN 40 and that untagged traffic is not silently placed into a privileged VLAN. This both restores proper guest connectivity via VLAN 40 and prevents native VLAN hopping or leaks.

Answer

Convert the AP uplink to an access port in VLAN 40 and leave the AP to handle all traffic untagged.

Answer

Add the internal printer VLAN to the allowed list so the AP can filter client traffic itself.

Answer

Keep the trunk settings and add a layer 3 ACL between the guest and internal networks.

Question 7

A network team must manage switches from home without exposing management ports to the internet. Which two controls best fit? Select two.

Accepted Answer

Require a VPN before allowing access to the management network.. Requiring a VPN before allowing access to the management network ensures that management interfaces are never directly exposed to the internet; all remote traffic must first go through an authenticated and encrypted tunnel, providing network-level security and segmentation. In addition, using SSH for command-line administration ensures that even within that secure channel (and for any other administrative sessions), the data is encrypted and authenticated, protecting against eavesdropping and credential theft. Together, these two controls provide defense in depth: the VPN prevents public exposure of management ports, while SSH secures the actual administrative session.

Answer

Expose the switch web interface directly on a public IP address.

Answer

Use FTP to transfer configuration files because it is simple.

Answer

Send management passwords by email to approved admins.

Question 8

An organization wants employees to sign in once and then access several SaaS applications without repeated logins. Which two technologies make this possible? Select two.

Accepted Answer

Single sign-on. Single sign-on (SSO) allows a user to authenticate once and then access multiple applications without re-entering credentials. Identity federation extends this by establishing trust relationships between different organizations or identity domains, so that a single authentication event can be accepted by multiple SaaS applications. SSO provides the user session and token handling, while federation provides the trust framework (e.g., SAML, OIDC) that lets each application accept the SSO token. Together, they enable seamless access to multiple SaaS apps after a single sign-in.

Answer

Network address translation

Answer

Port forwarding

Answer

Full-disk encryption

Question 9

Based on the exhibit, which configuration best reduces exposure for the public web application while keeping the backend tiers protected?

Accepted Answer

Keep the reverse proxy in the DMZ and place the application and database servers in private subnets behind it.. The reverse proxy should remain in the DMZ, while the application and database servers stay in separate private VLANs behind it. Option B correctly identifies this layered design as the best configuration for reducing exposure. Moving the database to the DMZ (A), permitting direct Internet access to the application server (C), or collapsing all servers into one VLAN (D) would weaken segmentation and increase risk.

Answer

Move the database server into the DMZ so the public proxy can reach it directly.

Answer

Allow inbound Internet access directly to the application server on 8443, but restrict the database.

Answer

Collapse all servers into one VLAN and rely on strong passwords for protection.

Question 10

Several corporate laptops occasionally boot from a removable drive containing an untrusted recovery tool before Windows loads. The security team wants to reduce the chance of pre-boot tampering and unauthorized boot media use. Which two controls are most effective? Select two.

Accepted Answer

Enable UEFI Secure Boot.. UEFI Secure Boot ensures that only signed, trusted bootloaders and drivers are executed during the boot process, preventing unauthorized boot media from loading. Additionally, disabling boot from external media directly prevents the system from attempting to boot from removable drives, and protecting firmware setup with a password prevents unauthorized changes to boot order. Together, these controls reduce pre-boot tampering and unauthorized boot media use.

Answer

Keep local administrator rights so users can recover faster.

Answer

Turn off disk encryption because it slows startup.

Answer

Move the laptops to a different subnet.

Question 11

Select each statement that correctly describes a traffic control.

Accepted Answer

ACLs: Filters traffic based on source/destination IP addresses and ports.. ACLs filter based on IPs/ports; QoS prioritizes traffic; shaping controls rate; policing drops excess; NAT translates addresses; port security limits MACs per port.

Answer

ACLs: Prioritizes traffic to ensure performance.

Answer

QoS: Translates private IP addresses to public IP.

Question 12

A finance team deploys a regulated workload to a public cloud. They want operating system login events, process activity, and network flow metadata to be retained in one central place for detection and investigation. Which action best supports this requirement with the least operational overhead?

Accepted Answer

Enable cloud-native logging and forward guest telemetry from the workload into a centralized security logging service or SIEM.. It directly addresses the requirement to centralize OS login events, process activity, and network flow metadata from a public cloud workload. Cloud-native logging services can capture guest OS telemetry via agents (e.g., Amazon CloudWatch Agent, Azure Log Analytics agent) and forward it to a centralized security logging service or SIEM, minimizing operational overhead by leveraging built-in cloud services rather than custom infrastructure.

Answer

Rely on the cloud provider to automatically secure all guest operating systems and collect every log type by default.

Answer

Move the workload to a private data center so the cloud provider can no longer access any telemetry.

Answer

Disable host logging and rely only on perimeter firewall logs to reduce storage costs.

Question 13

A company wants its laptop fleet to start from a known configuration before shipping to users and to reduce exposure to newly discovered vulnerabilities over time. Which two actions are best? Select two.

Accepted Answer

Build the laptops from a secure baseline image.. Building laptops from a secure baseline image ensures that every device starts with a known, hardened configuration, eliminating any pre-existing vulnerabilities or misconfigurations. This directly supports the requirement to begin from a known good state before shipping to users. Additionally, applying security patches on a regular schedule reduces exposure to newly discovered vulnerabilities over time by ensuring that known exploits are mitigated promptly. Both actions together meet the stated goals.

Answer

Install extra consumer applications by default.

Answer

Allow users to disable endpoint protection whenever they want.

Answer

Delay firmware updates until devices fail.

Question 14

A branch office uses a flat LAN, and a compromise on one user workstation could spread quickly to finance systems. Management wants finance workstations isolated from general users, but finance staff still need access to a central finance application and network printer. What is the best design change?

Accepted Answer

Create separate VLANs for finance and user devices, then apply inter-VLAN ACLs to allow only required application and printer traffic.. Creating separate VLANs segments the flat LAN into isolated broadcast domains, preventing lateral movement from compromised user workstations to finance systems. Inter-VLAN ACLs then permit only the specific required traffic (e.g., TCP 1433 for the finance application, TCP 9100 for the printer) while blocking all other inter-VLAN communication. This aligns with the principle of least privilege and network segmentation, directly addressing the requirement to isolate finance workstations without disrupting their needed access.

Answer

Move finance devices to the guest Wi-Fi network so they are separated from employees.

Answer

Keep the flat LAN but require stronger passwords on finance PCs and shared folders.

Answer

Place all devices in one VLAN and rely on endpoint antivirus to stop spread.

Question 15

A branch office has users, finance workstations, printers, and IP phones on one flat LAN. After a malware outbreak on a user PC, management wants to limit lateral movement without blocking printing or voice traffic. What should the network team implement?

Accepted Answer

Create separate VLANs for device groups and apply inter-VLAN ACLs that permit only required traffic.. Segmenting devices into separate VLANs (e.g., users, finance, printers, IP phones) and applying inter-VLAN ACLs restricts lateral movement by default while permitting only necessary traffic like printing (TCP 9100) and voice (RTP/UDP 16384-32767). This aligns with the principle of least privilege and zero trust segmentation, preventing malware from spreading across the flat LAN without disrupting critical services.

Answer

Move all devices into one larger subnet and rely on endpoint antivirus for separation.

Answer

Place all devices behind a single proxy server and block all internal east-west traffic.

Answer

Enable port security on the switch and disable all VLAN tagging to reduce complexity.

Question 16

A small company is deploying a public web application with a front-end server, an application server, and a database. Which two design choices best reduce exposure of the backend systems? Select two.

Accepted Answer

Place the web server in a DMZ that is reachable from the internet.. Placing the web server in a DMZ (demilitarized zone) allows it to be reachable from the internet while isolating it from the internal network. This design ensures that even if the web server is compromised, an attacker cannot directly access the application server or database, as traffic must pass through a firewall with strict rules. The DMZ acts as a buffer zone, reducing the attack surface of backend systems.

Answer

Put the database on the same subnet as the web server for faster communication.

Answer

Allow every tier to communicate freely to simplify troubleshooting.

Answer

Use one flat VLAN for all three servers and rely on strong passwords.

Question 17

A finance portal lets one employee create a payment batch and approve it without review. Management wants to reduce fraud risk while keeping the workflow functional. Which two changes best achieve that goal? Select two.

Accepted Answer

Separate the create and approve functions into different roles or groups.. Separation of duties (A) prevents a single individual from both creating and approving a payment batch, which reduces fraud risk. Adding an independent approval step (B) ensures that a different person reviews and authorizes the payment before it is released, further enforcing separation of duties and preventing fraudulent transactions without eliminating the workflow. Together, these controls require collusion between two employees to commit fraud.

Answer

Give the same user broader administrative access to avoid delays.

Answer

Allow the same role to perform both actions but log the activity after the fact.

Answer

Remove authentication so the process is faster.

Question 18

A company wants guest laptops on Wi-Fi to reach the internet, but not internal file servers or printers. Which two changes best support that design? Select two.

Accepted Answer

Place guest devices in a separate VLAN or subnet from employee devices.. Placing guest devices in a separate VLAN or subnet (Option A) is a fundamental network segmentation technique that isolates guest traffic from the internal corporate network at Layer 2 and Layer 3. This ensures that guest laptops cannot directly communicate with internal file servers or printers unless explicitly routed, and it allows the administrator to apply distinct security policies to the guest subnet. Adding ACL or firewall rules (Option B) is also necessary to explicitly block guest traffic from reaching internal private networks, enforcing the separation at the network layer. Together, these two changes ensure guests can reach the internet while being prevented from accessing internal resources.

Answer

Put guests on the same VLAN as employees and rely on stronger Wi-Fi passwords.

Answer

Disable SSID broadcast so guests cannot discover the network name.

Answer

Allow guest devices to use the same DHCP scope as internal endpoints.

Question 19

A company is redesigning a customer portal. Internet users must reach only the web tier, the web tier must talk to the application tier, and the application tier must talk to the database tier. The security team also wants to reduce lateral movement if one server is compromised. Which three changes best meet these goals? Select three.

Accepted Answer

Place the web tier in a DMZ and publish only the reverse proxy or load balancer to the internet.. Placing the web tier in a DMZ and publishing only the reverse proxy or load balancer to the internet ensures that external users can only reach the web tier, not the application or database tiers. This aligns with the requirement to restrict internet access to the web tier only, while the reverse proxy or load balancer can inspect and forward traffic, reducing the attack surface. Placing the database tier in a separate internal subnet and allowing traffic only from the application tier restricts database access to the application tier, preventing direct exposure and limiting lateral movement. Using host-based or microsegmentation rules to restrict east-west traffic between tiers further reduces lateral movement by enforcing least privilege at the workload level, so even if one server is compromised, the attacker cannot easily move to other tiers.

Answer

Put the web, application, and database servers in the same flat VLAN so routing is simpler.

Answer

Give the database tier direct internet access for vendor patching and cloud backups.

Question 20

Employees use one corporate login to sign in to email, the ticketing portal, and the HR application. After signing in once, the other apps accept the same identity without separate passwords. What capability is this?

Accepted Answer

Single sign-on (SSO). Single sign-on (SSO) allows a user to authenticate once and gain access to multiple applications without re-entering credentials. In this scenario, the corporate login provides a token (e.g., Kerberos ticket or SAML assertion) that is accepted by the email, ticketing portal, and HR application, eliminating the need for separate passwords. This is the core capability of SSO.

Answer

Federation

Answer

Multi-factor authentication (MFA)

Answer

Session timeout