SY0-701 Security Architecture Practice Test 10 — 15 Questions

Question 1

A help desk team wants users to be unable to install unsanctioned browser extensions or freeware on corporate Windows laptops, while approved business apps still run. Which endpoint control is best?

Accepted Answer

Application allowlisting or application control.. Application allowlisting (or application control) is the correct endpoint control because it explicitly defines which software executables, scripts, and installers are permitted to run on the system. By default, all unapproved applications—including unsanctioned browser extensions and freeware—are blocked, while approved business apps are allowed to execute. This directly addresses the requirement to prevent unauthorized installations while maintaining normal operations for sanctioned software.

Answer

Full-disk encryption on every laptop.

Answer

A remote access VPN.

Answer

A desktop wallpaper policy.

Question 2

A security team discovers that several laptops occasionally boot from a removable drive before Windows loads, allowing unapproved recovery tools to run. Management wants to prevent this with the least impact on normal users. Which control is the best fit?

Accepted Answer

Enable secure boot and restrict the firmware boot order so only the approved internal boot path is allowed.. Secure Boot ensures that only signed, trusted firmware and bootloaders execute during the startup process. By restricting the firmware boot order to the internal drive only, the laptop will ignore removable media during boot, preventing unapproved recovery tools from running before Windows loads. This has minimal impact on normal users because they can still use USB devices after the OS has booted.

Answer

Disable all USB ports permanently on every laptop.

Answer

Uninstall the endpoint protection agent and replace it with manual inspections.

Answer

Move user data to cloud storage so rogue boot media can no longer access it.

Question 3

A company uses several SaaS applications and wants employees to sign in once with a corporate account instead of maintaining separate passwords for each app. Which architecture is best?

Accepted Answer

Federated single sign-on with a central identity provider.. Federated single sign-on (SSO) with a central identity provider (IdP) allows users to authenticate once using their corporate account (e.g., via SAML 2.0 or OIDC) and then access multiple SaaS applications without re-entering credentials. The IdP issues a token that each SaaS app trusts, eliminating the need for separate passwords while maintaining centralized control over authentication policies.

Answer

Shared generic accounts for each department.

Answer

A separate username and password database in every SaaS application.

Answer

A site-to-site VPN for every SaaS vendor.

Question 4

A regulated analytics workload must run in the cloud with the strongest isolation from other customers, but the company does not want to manage its own physical server room. Which placement is most appropriate?

Accepted Answer

A dedicated host or equivalent single-tenant compute placement in the provider's environment.. A dedicated host or single-tenant compute placement ensures that the physical server is not shared with any other customer, providing the strongest isolation required for regulated workloads. This model meets the compliance need for physical separation while still being a cloud service, so the company avoids managing its own server room.

Answer

A public subnet with an internet gateway so the workload can be reached directly.

Answer

A shared-tenancy virtual machine in the provider's default compute pool.

Answer

A serverless function because it removes all underlying infrastructure concerns.

Question 5

The help desk can patch endpoints only after testing on a few pilot systems because one legacy app sometimes breaks after updates. What patching approach is most secure and least disruptive?

Accepted Answer

Apply updates to a small pilot group first, then roll them out in stages to the rest of the fleet.. It follows a phased rollout strategy: testing on a small pilot group first validates compatibility with the legacy app, then staged deployment minimizes disruption while ensuring security patches are applied promptly. This balances the need for security updates with the operational requirement to avoid breaking critical legacy software.

Answer

Wait until all applications are fully modernized before installing any security updates.

Answer

Patch every endpoint immediately at the same time without testing to reduce management overhead.

Answer

Disable automatic updates permanently and patch only after a confirmed incident.

Question 6

A company moves a Linux server to infrastructure as a service (IaaS). Which task remains the customer's responsibility?

Accepted Answer

Patching the guest operating system and installed applications.. In an IaaS model, the cloud provider manages the physical infrastructure, hypervisor, and network backbone, while the customer retains responsibility for securing and maintaining the guest operating system and any installed applications. This includes applying security patches, updating software, and configuring the OS-level firewall. For a Linux server, the customer must run commands like `apt update && apt upgrade` or `yum update` to patch the OS and manage application dependencies.

Answer

Replacing failed power supplies in the data center.

Answer

Maintaining the hypervisor on the host system.

Answer

Building and securing the provider's network backbone.

Question 7

A small company is redesigning its network for a public web application. The web front end must be reachable from the internet, but the database should never be exposed directly to external or general user traffic. Which architecture is the best choice?

Accepted Answer

Place the web server in a DMZ and keep the database in a private internal subnet with only required application traffic allowed.. It implements a layered security architecture: the web server resides in a DMZ (demilitarized zone) where it is reachable from the internet, while the database is placed in a private internal subnet with strict firewall rules that only allow the required application traffic (e.g., TCP port 3306 for MySQL or 1433 for MSSQL) from the web server. This ensures the database is never directly exposed to external or general user traffic, reducing the attack surface and preventing direct internet-based attacks on the database.

Answer

Place both the web server and database in the same internal subnet and rely on host firewalls.

Answer

Place the database in the DMZ so the web server can query it directly without internal routing.

Answer

Keep both systems public but restrict access with NAT and strong administrator passwords.

Question 8

A company wants employees to use their normal login from managed devices but require extra verification when they sign in from an unmanaged laptop or a new location. Which two controls should the team use? Select two.

Accepted Answer

Conditional access. Conditional access (A) is correct because it allows the company to define policies that grant or block access based on conditions such as device compliance (managed vs. unmanaged) and location (trusted vs. new). Multi-factor authentication (B) is correct because it provides the extra verification step required when the conditional access policy detects an unmanaged laptop or a new location, ensuring the user proves their identity beyond just a password.

Answer

DNS filtering

Answer

Disk encryption

Answer

Port security

Question 9

A regulated workload must run in the cloud with the strongest possible isolation from other tenants, and the company wants to avoid managing its own physical hardware. Which placement is the best fit?

Accepted Answer

Use a dedicated host so the underlying hardware is allocated to one customer only.. A dedicated host provides the strongest possible isolation by ensuring that the physical server is not shared with any other tenant. This meets the requirement for a regulated workload without the company managing its own hardware, as the cloud provider still handles maintenance and patching.

Answer

Use a shared tenancy instance with tighter security groups and a private subnet.

Answer

Move the workload into a public subnet so the provider can inspect traffic more easily.

Answer

Use a container within a shared platform because containers always isolate tenants completely.

Question 10

An HR portal has three job functions: HR staff update employee records, managers approve leave requests, and payroll views salary data. The security team wants to prevent any one role from having all capabilities. Which access design is the best fit?

Accepted Answer

Create role-based access groups aligned to each job function and grant only the permissions needed for that role.. Role-based access control (RBAC) is the correct design because it enforces the principle of least privilege by granting each job function only the permissions necessary for its tasks. This prevents any single role from accumulating all capabilities (e.g., HR staff cannot approve leave or view salary data), directly addressing the security team's requirement to separate duties. RBAC aligns with NIST SP 800-53 AC-6 and is a standard access control model for multi-role enterprise applications.

Answer

Use a single superuser account for the entire department so tasks can be completed quickly.

Answer

Give every employee access to all portal features and depend on audit logs to catch mistakes later.

Answer

Require the payroll team to share one common password and use it only from the office network.

Question 11

An HR portal has three groups: HR staff can edit employee records, managers can approve leave, and payroll can view salary data. No one should have all functions. Which access model should the engineer implement?

Accepted Answer

Role-based access control with separate groups mapped to each business function.. Role-Based Access Control (RBAC) allows the engineer to define three distinct roles (HR staff, managers, payroll) with granular permissions mapped to specific business functions, ensuring no single user inherits all privileges. This model enforces the principle of least privilege by separating duties across groups, preventing any user from having full access to the portal's sensitive operations.

Answer

A single shared admin account so all tasks can be completed quickly.

Answer

Mandatory access control with all users assigned the same clearance level.

Answer

Local account creation on the portal for each user, with permissions assigned manually one by one.

Question 12

A help desk team manages 300 Windows laptops. A legacy accounting app sometimes fails after updates, so the company wants to reduce patch risk while still preventing long-term exposure. Which patching strategy is the best balance?

Accepted Answer

Use a pilot group and phased rollout process before wider deployment.. A pilot group with phased rollout lets the team validate patches against the legacy accounting app on a small subset before broad deployment, catching compatibility regressions while still meeting patch SLAs. This balances availability risk against the security risk of unpatched systems.

Answer

Apply updates manually to each laptop as soon as they are released.

Answer

Postpone all updates until the legacy accounting app is replaced.

Answer

Disable automatic updates permanently and patch only after a security incident.

Question 13

A regulated analytics workload must run in a public cloud with the strongest practical tenant isolation while avoiding management of physical servers. The workload should also remain off the public internet. Which two deployment choices best fit? Select two.

Accepted Answer

Run the workload on a dedicated host or dedicated instance.. A dedicated host or dedicated instance provides the strongest practical tenant isolation in a public cloud by ensuring that the underlying physical server is not shared with any other customer. This meets the regulatory requirement for strong isolation while avoiding the need to manage physical servers, as the cloud provider still handles hardware maintenance. The dedicated instance model (e.g., AWS Dedicated Instances) offers hardware-level isolation at the instance level, while a dedicated host gives you visibility and control over the physical server, both without requiring you to manage the server itself.

Answer

Use shared tenancy with security groups only.

Answer

Assign an elastic IP so administrators can reach the workload directly from anywhere.

Answer

Expose the workload through a public load balancer to simplify connectivity.

Question 14

A company moved an internal application to a cloud virtual machine. The security team wants operating system login events, process activity, and network flow metadata to be available in the SIEM for investigations. Which action best supports that goal?

Accepted Answer

Enable guest OS audit logging and cloud-native flow logs, then forward the data to the SIEM.. It directly addresses the requirement to collect operating system login events, process activity, and network flow metadata. Enabling guest OS audit logging (e.g., via Windows Event Log or syslog) captures login and process events, while cloud-native flow logs (e.g., AWS VPC Flow Logs or Azure NSG flow logs) provide network flow metadata. Forwarding both data streams to the SIEM ensures centralized visibility for investigations.

Answer

Rely only on the cloud provider's service health dashboard and billing alerts.

Answer

Encrypt the virtual machine disks and disable all logging to reduce exposure.

Answer

Install only a web application firewall because that covers server log collection.

Question 15

A company manages 300 laptops and wants to reduce risk from missed patches while avoiding a widespread outage if an update has compatibility issues. Which patching approach is the best choice?

Accepted Answer

Use a phased rollout with a pilot group, then expand deployment after validation, while keeping a standard baseline configuration.. A phased rollout with a pilot group allows the IT team to validate patches on a small subset of laptops before full deployment, reducing the risk of widespread outages from compatibility issues. Maintaining a standard baseline configuration ensures consistency across all 300 laptops, which simplifies patch management and reduces the likelihood of missed patches. This approach balances risk mitigation with operational continuity, aligning with best practices for enterprise patch management.

Answer

Install patches manually on each laptop after users report problems.

Answer

Deploy all patches to every laptop immediately with no testing.

Answer

Wait for annual maintenance windows so all changes happen at once.