SY0-701 Security Architecture Practice Test 11 — 15 Questions

Question 1

A company is redesigning a customer portal. Internet users must reach only the web tier, the web tier must talk to the application tier, and the application tier must talk to the database tier. The security team also wants to reduce lateral movement if one server is compromised. Which three changes best meet these goals? Select three.

Accepted Answer

Place the web tier in a DMZ and publish only the reverse proxy or load balancer to the internet.. Option A is correct because placing the web tier in a DMZ and publishing only the reverse proxy or load balancer to the internet ensures that external users can only reach the web tier, not the application or database tiers. This aligns with the requirement to restrict internet access to the web tier only, while the reverse proxy or load balancer can inspect and forward traffic, reducing the attack surface. It also supports the goal of reducing lateral movement by isolating the web tier from internal networks.

Answer

Put the web, application, and database servers in the same flat VLAN so routing is simpler.

Answer

Give the database tier direct internet access for vendor patching and cloud backups.

Question 2

A company is redesigning how systems are separated in its office and data center network. Match each network design element to the scenario it best supports. Use each term once.

Question 3

Employees use one corporate login to sign in to email, the ticketing portal, and the HR application. After signing in once, the other apps accept the same identity without separate passwords. What capability is this?

Accepted Answer

Single sign-on (SSO). Single sign-on (SSO) allows a user to authenticate once and gain access to multiple applications without re-entering credentials. In this scenario, the corporate login provides a token (e.g., Kerberos ticket or SAML assertion) that is accepted by the email, ticketing portal, and HR application, eliminating the need for separate passwords. This is the core capability of SSO.

Answer

Federation

Answer

Multi-factor authentication (MFA)

Answer

Session timeout

Question 4

After a server rebuild, a Windows administrator notices several unneeded services are still enabled, including Remote Registry and Print Spooler on a server that only hosts a database. What should the administrator do to reduce attack surface and keep the build consistent?

Accepted Answer

Apply the approved secure baseline and disable unnecessary services.. Applying an approved secure baseline and disabling unnecessary services (Option B) directly reduces the attack surface by removing potential entry points like Remote Registry (which allows remote modification of the registry) and Print Spooler (which has known privilege escalation vulnerabilities, e.g., CVE-2021-34527). This also ensures build consistency by enforcing a standardized configuration across all servers, which is critical for compliance and manageability in a Windows environment.

Answer

Install additional endpoint monitoring agents to compensate for the extra services.

Answer

Increase the disk encryption key size to protect the running services.

Answer

Move the server to a different subnet and leave the configuration unchanged.

Question 5

A Windows file server was rebuilt from a gold image, but later troubleshooting re-enabled Remote Desktop, SMBv1, and the Print Spooler. The security team wants to harden the host and catch the same configuration changes early in the future. Which three actions are the best fit? Select three.

Accepted Answer

Disable unnecessary services and remove legacy protocols that are not required.. Option A is correct because disabling unnecessary services like the Print Spooler and removing legacy protocols such as SMBv1 directly reduces the attack surface. SMBv1 is known for vulnerabilities like EternalBlue (MS17-010), and the Print Spooler has been exploited in PrintNightmare attacks. This aligns with the principle of least functionality, a core security architecture concept.

Answer

Leave all management ports open so technicians can troubleshoot from anywhere.

Answer

Turn off logging to reduce the chance that attackers can see the server.

Question 6

A development team stores container images in a registry before deployment. Security wants to reduce the chance of shipping vulnerable libraries or packages inside the image. What should the team do before release?

Accepted Answer

Scan the image and rebuild it from an approved base image.. Scanning the image for known vulnerabilities (CVEs) and rebuilding it from an approved, hardened base image ensures that only trusted, patched libraries and packages are included. This directly reduces the attack surface by eliminating vulnerable components before the image is deployed to production.

Answer

Run the container as root so startup problems are less likely.

Answer

Open the container port on the host firewall so the image can be reached faster.

Answer

Add more CPU and memory to the cluster to improve image security.

Question 7

A customer portal must keep serving requests if one application server stops responding. The team wants traffic to be sent to whichever healthy server is available. Which design should they implement?

Accepted Answer

A load balancer in front of multiple application servers. A load balancer distributes incoming traffic across multiple application servers and performs health checks (e.g., HTTP GET requests to a /health endpoint) to detect failures. If one server stops responding, the load balancer automatically routes requests only to the remaining healthy servers, ensuring continuous availability. This design directly meets the requirement for fault tolerance and active traffic distribution.

Answer

A RAID 1 array in the application server

Answer

A snapshot of the application server before each update

Answer

A longer password policy for the portal administrators

Question 8

A customer portal must stay online if an entire site fails, and the company must also be able to recover if data is corrupted or encrypted by ransomware. Which two design choices best satisfy both requirements? Select two.

Accepted Answer

Use active-active or automatic failover between two sites with health checks.. Option A is correct because active-active or automatic failover between two sites with health checks ensures that if an entire site fails, traffic is automatically redirected to the surviving site, maintaining availability. This design satisfies the first requirement of staying online during a site failure by using redundant infrastructure and health monitoring to detect and react to outages.

Answer

Keep only RAID 1 inside each server, because mirroring alone handles site outages.

Answer

Store nightly backups on the same storage array as the production data.

Answer

Replace the load balancer with a static DNS record for each server.

Question 9

Guest tablets in a conference room use the same physical switches as employee devices. The security team wants guests to have internet access only, with no route to internal subnets. Which design best meets the goal?

Accepted Answer

Place guests on a separate VLAN and block internal access with ACLs.. Option B is correct because placing guest tablets on a separate VLAN segments traffic at Layer 2, and applying ACLs on the Layer 3 interface (SVI or router) blocks all routes to internal subnets while permitting internet access. This design ensures that even though guests share the same physical switches, their traffic is isolated from employee VLANs and cannot reach internal resources.

Answer

Keep guests on the same VLAN and rely on a separate Wi-Fi password.

Answer

Use stronger WPA3 encryption on the wireless network and leave the network flat.

Answer

Enable MAC address filtering on the switch and allow all ports to remain in the default network.

Question 10

After a server rebuild, a Linux database host still has several unnecessary services enabled, including a graphical desktop, Telnet, and a printer service. The operations team wants a secure baseline that prevents the same drift from happening again after future maintenance. Which two actions best address the issue? Select two.

Accepted Answer

Remove the unused packages and disable the unnecessary services and ports.. Removing unused packages and disabling unnecessary services directly reduces the attack surface by eliminating potential entry points like Telnet (which transmits credentials in cleartext) and unused printer services. This aligns with the principle of least functionality, ensuring only required services run on the Linux database host.

Answer

Allow administrators to enable any service they need without approval during maintenance windows.

Answer

Keep the default installation profile so vendor updates are easier to apply.

Answer

Open the firewall broadly and rely only on strong passwords.

Question 11

Employees sign in once to the company portal and then can access email, the ticketing system, and the HR site without logging in again. What is this called?

Accepted Answer

Single sign-on. Single sign-on (SSO) allows a user to authenticate once and gain access to multiple applications or systems without re-entering credentials. In this scenario, the company portal acts as the identity provider (IdP), and after initial authentication, it issues a token (e.g., SAML assertion or Kerberos ticket) that is accepted by the email, ticketing, and HR systems as proof of identity. This eliminates the need for repeated logins across these services.

Answer

Port forwarding

Answer

Tokenization

Answer

Network address translation

Question 12

A web application must be reachable from the internet, but its database should be isolated from direct internet access. Which two placements or controls are most appropriate? Select two.

Accepted Answer

Place the web server in a DMZ.. Placing the web server in a DMZ (Option A) allows it to be reachable from the internet while the internal firewall restricts inbound traffic to only necessary ports (e.g., TCP 80/443). Keeping the database on an internal network segment (Option B) and configuring firewall rules to allow traffic only from the web server’s IP address ensures the database is isolated from direct internet access, preventing external attacks on the database service.

Answer

Place both the web server and the database on the same internet-facing subnet.

Answer

Expose the database port to the internet so administrators can connect faster.

Answer

Use the guest wireless VLAN for both systems.

Question 13

A Linux operations team has a standing need to restart services and edit protected configuration files on production servers, but administrators should not keep root privileges all day. Every elevation must be approved through a ticket and logged centrally. Which solution best meets this requirement?

Accepted Answer

Use privileged access management with just-in-time elevation and session logging. Privileged Access Management (PAM) with just-in-time (JIT) elevation and session logging meets the requirement because it grants temporary, request-based root privileges that are automatically revoked after the task, and it centrally logs all commands executed during the elevated session. This ensures every elevation is approved via a ticket and auditable, without administrators retaining permanent root access.

Answer

Create one shared root password and rotate it weekly

Answer

Assign each administrator the server local administrator role permanently

Answer

Use single sign-on so administrators only authenticate once each morning

Question 14

An organization is placing its public-facing website behind a new security design. The site must be reachable from the internet, but the database and file servers must stay isolated from direct external access. What design should the architect use?

Accepted Answer

Create a demilitarized zone (DMZ) for the public web server.. A demilitarized zone (DMZ) is a network segment that isolates public-facing services, such as a web server, from the internal network. By placing the web server in the DMZ, the organization allows internet traffic to reach the website while keeping the database and file servers on the internal network, which are not directly accessible from the internet. This design enforces a security boundary where only necessary traffic (e.g., HTTP/HTTPS) is permitted through firewall rules, preventing direct external access to sensitive backend systems.

Answer

Place the web server on the internal user subnet so it can reach the database directly.

Answer

Use a VPN concentrator so the website can be accessed securely from outside.

Answer

Use network address translation (NAT) on the web server to hide its IP address.

Question 15

A help desk team wants guest Wi-Fi users to access only the internet and nothing on the internal corporate network. Which control should the network team implement at the wireless edge?

Accepted Answer

An ACL or firewall rule set that blocks guest network access to internal subnets. To prevent guest Wi-Fi users from accessing the internal corporate network while allowing internet access, the network team must implement an ACL or firewall rule set at the wireless edge. This control explicitly blocks traffic from the guest VLAN/subnet to internal subnets (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) while permitting outbound traffic to the internet. This is a fundamental network segmentation technique that enforces the principle of least privilege at Layer 3/4.

Answer

A single shared password for all guest users

Answer

A stronger DNS server

Answer

A longer Wi-Fi passphrase rotated monthly