SY0-701 Security Architecture Practice Test 10 — 15 Questions

Question 1

An organization is redesigning access for its HR portal. HR staff need to update employee records, managers need to approve leave requests, and payroll staff need access to salary data, but no single user should receive all of those permissions by default. What is the best access model?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create separate roles for HR, managers, and payroll, and grant only the permissions needed for each job function.. Role-Based Access Control (RBAC) assigns permissions based on job functions, ensuring that HR staff, managers, and payroll personnel receive only the privileges necessary for their roles. This enforces the principle of least privilege and prevents any single user from inheriting all permissions by default, which aligns with the organization's security requirement.

Answer

Assign everyone the same portal permissions to simplify administration.

Answer

Give every manager full HR and payroll access so approvals are faster.

Answer

Use one shared administrator account for all HR actions to keep audits simple.

Question 2

A small company is publishing an internal website to the internet. The security team wants the web server reachable from the internet while keeping the database and file share isolated from direct internet access. Which design is best?

Accepted Answer

Place the web server in a DMZ and keep the database and file share on a private internal subnet.. It implements a DMZ architecture where the web server is placed in a publicly accessible network segment, while the database and file share reside on a private internal subnet. This design ensures that even if the web server is compromised, an attacker cannot directly access the internal resources because firewall rules restrict inbound traffic to only the DMZ and block any initiated connections from the DMZ to the internal network. This follows the principle of defense in depth and network segmentation as recommended by CompTIA for securing multi-tier applications.

Answer

Place the web server and database on the same flat internal network behind the firewall.

Answer

Place the database in the DMZ and keep the web server on the internal user VLAN.

Answer

Use a VPN for all users and keep every server on the same subnet.

Question 3

A company wants to stop employees from running unauthorized tools downloaded from the internet on managed Windows laptops, but still allow approved internal apps and vendor-updated software. Which control is best?

Accepted Answer

Application control using an allowlist for approved executables and publishers.. Application control with an allowlist (also known as whitelisting) is the correct choice because it explicitly defines which executables, scripts, and publishers are permitted to run on managed Windows laptops. This prevents unauthorized tools downloaded from the internet from executing, while allowing approved internal apps and vendor-updated software that match the allowlist criteria. Technologies like Windows Defender Application Control (WDAC) or AppLocker enforce this by checking file hashes, publisher signatures, or path rules at runtime.

Answer

Full-disk encryption on every laptop before deployment.

Answer

A stronger screen-lock timeout and automatic logoff policy.

Answer

A firmware password for the BIOS without any other endpoint restrictions.

Question 4

A help desk team wants users to be unable to install unsanctioned browser extensions or freeware on corporate Windows laptops, while approved business apps still run. Which endpoint control is best?

Accepted Answer

Application allowlisting or application control.. Application allowlisting (or application control) is the correct endpoint control because it explicitly defines which software executables, scripts, and installers are permitted to run on the system. By default, all unapproved applications—including unsanctioned browser extensions and freeware—are blocked, while approved business apps are allowed to execute. This directly addresses the requirement to prevent unauthorized installations while maintaining normal operations for sanctioned software.

Answer

Full-disk encryption on every laptop.

Answer

A remote access VPN.

Answer

A desktop wallpaper policy.

Question 5

A security team discovers that several laptops occasionally boot from a removable drive before Windows loads, allowing unapproved recovery tools to run. Management wants to prevent this with the least impact on normal users. Which control is the best fit?

Accepted Answer

Enable secure boot and restrict the firmware boot order so only the approved internal boot path is allowed.. Secure Boot ensures that only signed, trusted firmware and bootloaders execute during the startup process. By restricting the firmware boot order to the internal drive only, the laptop will ignore removable media during boot, preventing unapproved recovery tools from running before Windows loads. This has minimal impact on normal users because they can still use USB devices after the OS has booted.

Answer

Disable all USB ports permanently on every laptop.

Answer

Uninstall the endpoint protection agent and replace it with manual inspections.

Answer

Move user data to cloud storage so rogue boot media can no longer access it.

Question 6

A company uses several SaaS applications and wants employees to sign in once with a corporate account instead of maintaining separate passwords for each app. Which architecture is best?

Accepted Answer

Federated single sign-on with a central identity provider.. Federated single sign-on (SSO) with a central identity provider (IdP) allows users to authenticate once using their corporate account (e.g., via SAML 2.0 or OIDC) and then access multiple SaaS applications without re-entering credentials. The IdP issues a token that each SaaS app trusts, eliminating the need for separate passwords while maintaining centralized control over authentication policies.

Answer

Shared generic accounts for each department.

Answer

A separate username and password database in every SaaS application.

Answer

A site-to-site VPN for every SaaS vendor.

Question 7

A regulated analytics workload must run in the cloud with the strongest isolation from other customers, but the company does not want to manage its own physical server room. Which placement is most appropriate?

Accepted Answer

A dedicated host or equivalent single-tenant compute placement in the provider's environment.. A dedicated host or single-tenant compute placement ensures that the physical server is not shared with any other customer, providing the strongest isolation required for regulated workloads. This model meets the compliance need for physical separation while still being a cloud service, so the company avoids managing its own server room.

Answer

A public subnet with an internet gateway so the workload can be reached directly.

Answer

A shared-tenancy virtual machine in the provider's default compute pool.

Answer

A serverless function because it removes all underlying infrastructure concerns.

Question 8

The help desk can patch endpoints only after testing on a few pilot systems because one legacy app sometimes breaks after updates. What patching approach is most secure and least disruptive?

Accepted Answer

Apply updates to a small pilot group first, then roll them out in stages to the rest of the fleet.. It follows a phased rollout strategy: testing on a small pilot group first validates compatibility with the legacy app, then staged deployment minimizes disruption while ensuring security patches are applied promptly. This balances the need for security updates with the operational requirement to avoid breaking critical legacy software.

Answer

Wait until all applications are fully modernized before installing any security updates.

Answer

Patch every endpoint immediately at the same time without testing to reduce management overhead.

Answer

Disable automatic updates permanently and patch only after a confirmed incident.

Question 9

A company moves a Linux server to infrastructure as a service (IaaS). Which task remains the customer's responsibility?

Accepted Answer

Patching the guest operating system and installed applications.. In an IaaS model, the cloud provider manages the physical infrastructure, hypervisor, and network backbone, while the customer retains responsibility for securing and maintaining the guest operating system and any installed applications. This includes applying security patches, updating software, and configuring the OS-level firewall. For a Linux server, the customer must run commands like `apt update && apt upgrade` or `yum update` to patch the OS and manage application dependencies.

Answer

Replacing failed power supplies in the data center.

Answer

Maintaining the hypervisor on the host system.

Answer

Building and securing the provider's network backbone.

Question 10

A small company is redesigning its network for a public web application. The web front end must be reachable from the internet, but the database should never be exposed directly to external or general user traffic. Which architecture is the best choice?

Accepted Answer

Place the web server in a DMZ and keep the database in a private internal subnet with only required application traffic allowed.. It implements a layered security architecture: the web server resides in a DMZ (demilitarized zone) where it is reachable from the internet, while the database is placed in a private internal subnet with strict firewall rules that only allow the required application traffic (e.g., TCP port 3306 for MySQL or 1433 for MSSQL) from the web server. This ensures the database is never directly exposed to external or general user traffic, reducing the attack surface and preventing direct internet-based attacks on the database.

Answer

Place both the web server and database in the same internal subnet and rely on host firewalls.

Answer

Place the database in the DMZ so the web server can query it directly without internal routing.

Answer

Keep both systems public but restrict access with NAT and strong administrator passwords.

Question 11

A company wants employees to use their normal login from managed devices but require extra verification when they sign in from an unmanaged laptop or a new location. Which two controls should the team use? Select two.

Accepted Answer

Conditional access. Conditional access (A) is correct because it allows the company to define policies that grant or block access based on conditions such as device compliance (managed vs. unmanaged) and location (trusted vs. new). Multi-factor authentication (B) is correct because it provides the extra verification step required when the conditional access policy detects an unmanaged laptop or a new location, ensuring the user proves their identity beyond just a password.

Answer

DNS filtering

Answer

Disk encryption

Answer

Port security

Question 12

A regulated workload must run in the cloud with the strongest possible isolation from other tenants, and the company wants to avoid managing its own physical hardware. Which placement is the best fit?

Accepted Answer

Use a dedicated host so the underlying hardware is allocated to one customer only.. A dedicated host provides the strongest possible isolation by ensuring that the physical server is not shared with any other tenant. This meets the requirement for a regulated workload without the company managing its own hardware, as the cloud provider still handles maintenance and patching.

Answer

Use a shared tenancy instance with tighter security groups and a private subnet.

Answer

Move the workload into a public subnet so the provider can inspect traffic more easily.

Answer

Use a container within a shared platform because containers always isolate tenants completely.

Question 13

An HR portal has three job functions: HR staff update employee records, managers approve leave requests, and payroll views salary data. The security team wants to prevent any one role from having all capabilities. Which access design is the best fit?

Accepted Answer

Create role-based access groups aligned to each job function and grant only the permissions needed for that role.. Role-based access control (RBAC) is the correct design because it enforces the principle of least privilege by granting each job function only the permissions necessary for its tasks. This prevents any single role from accumulating all capabilities (e.g., HR staff cannot approve leave or view salary data), directly addressing the security team's requirement to separate duties. RBAC aligns with NIST SP 800-53 AC-6 and is a standard access control model for multi-role enterprise applications.

Answer

Use a single superuser account for the entire department so tasks can be completed quickly.

Answer

Give every employee access to all portal features and depend on audit logs to catch mistakes later.

Answer

Require the payroll team to share one common password and use it only from the office network.

Question 14

An HR portal has three groups: HR staff can edit employee records, managers can approve leave, and payroll can view salary data. No one should have all functions. Which access model should the engineer implement?

Accepted Answer

Role-based access control with separate groups mapped to each business function.. Role-Based Access Control (RBAC) allows the engineer to define three distinct roles (HR staff, managers, payroll) with granular permissions mapped to specific business functions, ensuring no single user inherits all privileges. This model enforces the principle of least privilege by separating duties across groups, preventing any user from having full access to the portal's sensitive operations.

Answer

A single shared admin account so all tasks can be completed quickly.

Answer

Mandatory access control with all users assigned the same clearance level.

Answer

Local account creation on the portal for each user, with permissions assigned manually one by one.

Question 15

A help desk team manages 300 Windows laptops. A legacy accounting app sometimes fails after updates, so the company wants to reduce patch risk while still preventing long-term exposure. Which patching strategy is the best balance?

Accepted Answer

Use a pilot group and phased rollout process before wider deployment.. A phased rollout with a pilot group is the most balanced approach. It allows the team to test new patches on a few systems that reflect the production environment before exposing the entire fleet to possible compatibility issues. That lowers operational risk while still ensuring the organization patches regularly, which is essential for reducing exposure to known vulnerabilities and maintaining a secure baseline.

Why others are wrong: Option A is too labor-intensive and still lacks controlled validation. Option C accepts avoidable risk by deferring all updates indefinitely. Option D is reactive and leaves the fleet exposed until an incident occurs. The correct answer is the only one that preserves security and operational stability at the same time.

Answer

Apply updates manually to each laptop as soon as they are released.

Answer

Postpone all updates until the legacy accounting app is replaced.

Answer

Disable automatic updates permanently and patch only after a security incident.