SY0-701 Security Architecture Practice Test 11 — 15 Questions

Question 1

A regulated analytics workload must run in a public cloud with the strongest practical tenant isolation while avoiding management of physical servers. The workload should also remain off the public internet. Which two deployment choices best fit? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run the workload on a dedicated host or dedicated instance.. A dedicated host or dedicated instance provides the strongest practical tenant isolation in a public cloud by ensuring that the underlying physical server is not shared with any other customer. This meets the regulatory requirement for strong isolation while avoiding the need to manage physical servers, as the cloud provider still handles hardware maintenance. The dedicated instance model (e.g., AWS Dedicated Instances) offers hardware-level isolation at the instance level, while a dedicated host gives you visibility and control over the physical server, both without requiring you to manage the server itself.

Answer

Use shared tenancy with security groups only.

Answer

Assign an elastic IP so administrators can reach the workload directly from anywhere.

Answer

Expose the workload through a public load balancer to simplify connectivity.

Question 2

A company moved an internal application to a cloud virtual machine. The security team wants operating system login events, process activity, and network flow metadata to be available in the SIEM for investigations. Which action best supports that goal?

Accepted Answer

Enable guest OS audit logging and cloud-native flow logs, then forward the data to the SIEM.. It directly addresses the requirement to collect operating system login events, process activity, and network flow metadata. Enabling guest OS audit logging (e.g., via Windows Event Log or syslog) captures login and process events, while cloud-native flow logs (e.g., AWS VPC Flow Logs or Azure NSG flow logs) provide network flow metadata. Forwarding both data streams to the SIEM ensures centralized visibility for investigations.

Answer

Rely only on the cloud provider's service health dashboard and billing alerts.

Answer

Encrypt the virtual machine disks and disable all logging to reduce exposure.

Answer

Install only a web application firewall because that covers server log collection.

Question 3

A company manages 300 laptops and wants to reduce risk from missed patches while avoiding a widespread outage if an update has compatibility issues. Which patching approach is the best choice?

Accepted Answer

Use a phased rollout with a pilot group, then expand deployment after validation, while keeping a standard baseline configuration.. A phased rollout with a pilot group allows the IT team to validate patches on a small subset of laptops before full deployment, reducing the risk of widespread outages from compatibility issues. Maintaining a standard baseline configuration ensures consistency across all 300 laptops, which simplifies patch management and reduces the likelihood of missed patches. This approach balances risk mitigation with operational continuity, aligning with best practices for enterprise patch management.

Answer

Install patches manually on each laptop after users report problems.

Answer

Deploy all patches to every laptop immediately with no testing.

Answer

Wait for annual maintenance windows so all changes happen at once.

Question 4

Employees use several SaaS applications, and the security team wants one corporate login, MFA for unmanaged devices, and centralized account provisioning. Which architecture should be used?

Accepted Answer

Use federated single sign-on with the corporate identity provider and conditional access policies.. Federated single sign-on (SSO) with a corporate identity provider (IdP) allows users to authenticate once using their corporate credentials and access multiple SaaS applications without separate logins. Conditional access policies can enforce MFA specifically for unmanaged devices, and centralized account provisioning (e.g., via SCIM) ensures accounts are created, updated, and deprovisioned from a single directory. This architecture meets all three requirements: single corporate login, MFA for unmanaged devices, and centralized provisioning.

Answer

Create separate usernames and passwords for each SaaS application.

Answer

Share one generic account for the team so access is easier to audit.

Answer

Put all users on a VPN and let each SaaS application trust the internal network automatically.

Question 5

A security team wants to reduce the chance that employees boot unmanaged tools from removable media and wants only approved software to run on laptops. Which two controls should they use? Select two.

Accepted Answer

Secure Boot. Secure Boot is correct because it ensures that only signed, trusted firmware and bootloaders execute during system startup, preventing unauthorized bootable media (e.g., USB drives with unmanaged OS images) from loading. This directly reduces the chance that employees can boot unmanaged tools from removable media by enforcing a chain of trust from UEFI firmware to the operating system kernel.

Answer

DNS forwarding

Answer

Longer screen-lock timeout

Answer

Public DNS resolvers

Question 6

A finance workflow currently lets one employee create a payment batch and approve it in the same session. Audit findings say the design increases fraud risk. Which two access architecture changes best reduce that risk while keeping the process functional? Select two.

Accepted Answer

Split the workflow into separate creator and approver roles.. Implementing separation of duties (SoD) by splitting the payment batch creation and approval into distinct roles ensures that no single user can both create and approve a transaction. This directly mitigates the fraud risk identified in the audit by requiring collusion between two users to execute a fraudulent payment. The process remains functional because the workflow is simply reordered into two sequential steps performed by different users.

Answer

Grant all finance users local administrator rights to speed up exception handling.

Answer

Store the payment password in a shared mailbox so the team can continue when someone is absent.

Answer

Remove approval steps entirely and rely on log reviews after payment runs.

Question 7

A development team is moving a regulated application to a cloud platform. The security architect wants the strongest practical separation from other customers without buying and operating physical servers. Which hosting option is most appropriate?

Accepted Answer

A dedicated host or isolated compute offering from the cloud provider.. A dedicated host or isolated compute offering (option B) provides the strongest practical separation because it ensures the application runs on a physical server dedicated solely to that customer, preventing any resource sharing or potential side-channel attacks from other tenants. This meets the regulatory requirement for strong isolation without the cost and operational overhead of purchasing and managing physical servers on-premises.

Answer

A shared multi-tenant environment with no additional security configuration.

Answer

Any public object storage service because the data will be encrypted by default.

Answer

A remote desktop service on the cheapest shared instance available.

Question 8

Based on the exhibit, which action best addresses both the unsanctioned software problem and the need for consistent endpoint configuration?

Exhibit:
Device group: Sales-Laptops
Baseline check:
- Approved browser: installed
- Approved EDR: installed
- Unapproved remote admin tool: detected on 14 endpoints
- Local administrator rights: granted to all users in group
- Patch compliance: 68%

Management wants to prevent unauthorized software from running and keep future builds consistent.

Accepted Answer

Deploy application allowlisting through centralized endpoint management and remove local administrator rights.. Application allowlisting (via AppLocker or Windows Defender Application Control) centrally enforces which software can run, directly addressing the unsanctioned remote admin tool. Removing local administrator rights prevents users from bypassing the allowlist or making unauthorized configuration changes, ensuring consistent endpoint builds and improving patch compliance by limiting user-driven modifications.

Answer

Keep users as local admins but require stronger email passwords for better overall security.

Answer

Disable the EDR agent during software installs to avoid false alerts from approved apps.

Answer

Store approved installers on a shared drive and let users choose what to install.

Question 9

Based on the exhibit, which hardening change best prevents a laptop from booting unapproved tools from external media?

Exhibit:
UEFI Setup
- Secure Boot: Disabled
- Boot order: USB, External NIC, Internal SSD
- Firmware admin password: Not configured
- BitLocker status: Enabled

Incident note:
A technician confirmed the laptop was started from a USB recovery stick that bypassed the normal corporate login workflow.

Accepted Answer

Enable Secure Boot and change the firmware boot order so only the internal SSD is allowed first.. Enabling Secure Boot ensures that only signed, trusted firmware and bootloaders can execute, preventing unauthorized tools like USB recovery sticks from loading. Changing the boot order to prioritize the internal SSD over USB media stops the system from even attempting to boot from external devices, directly addressing the incident where the laptop bypassed corporate login via a USB stick.

Answer

Extend the Windows login timeout so users have more time to notice suspicious activity.

Answer

Turn off BitLocker so recovery tools can boot without errors.

Answer

Install a host firewall rule to block USB storage devices from the network.

Question 10

Based on the exhibit, which access design change best reduces fraud risk without stopping the payroll process?

Exhibit:
Payroll application roles:
- HR-Editor: can update employee records
- Payroll-Approver: can release payment batches
- Audit-Reader: can view reports only

Current assignment:
User Lisa has both HR-Editor and Payroll-Approver because she "handles payroll end to end."
Management wants to reduce the chance of one person creating and approving a fraudulent payment.

Accepted Answer

Split duties so record updates and payment approval require separate roles or separate accounts.. It enforces separation of duties (SoD) by ensuring that no single user can both create and approve a payment. Splitting the HR-Editor and Payroll-Approver roles into separate accounts or requiring separate users for record updates and payment approval directly mitigates the fraud risk of a single insider creating a fake employee record and then approving a fraudulent payment batch. This aligns with the principle of least privilege and the NIST SP 800-53 AC-5 control for separation of duties, without halting the payroll workflow.

Answer

Keep both roles assigned but require a manager to review the batch after payment completes.

Answer

Remove the audit role and let payroll staff self-review their own work to save time.

Answer

Use a single shared payroll account so the workflow never pauses for approvals.

Question 11

After a server rebuild, an administrator notices that Remote Desktop, SMBv1, and Print Spooler are still enabled on a Windows file server even though the server only stores department documents. The security team also wants to know if future changes drift away from the approved build. What should be implemented?

Accepted Answer

Apply the approved secure baseline and enable configuration drift monitoring against it.. Applying an approved secure baseline (e.g., via Group Policy or Security Compliance Toolkit) ensures that unnecessary services like Remote Desktop, SMBv1, and Print Spooler are explicitly disabled. Enabling configuration drift monitoring (e.g., using Azure Policy, DSC, or a SIEM) allows the security team to detect and alert on any unauthorized changes that deviate from the baseline, addressing both the immediate risk and the long-term compliance requirement.

Answer

Keep the server as-is and rely on the antivirus console to stop misuse.

Answer

Move the server into a different VLAN and leave the operating system settings unchanged.

Answer

Schedule a monthly reboot to clear temporary settings and reduce attack surface.

Question 12

After building a new file server, an administrator reviews the security baseline and notices that a remote desktop service is enabled even though no one uses it. What is the best hardening action?

Accepted Answer

Disable the unnecessary service. The best hardening action is to disable the unnecessary remote desktop service because it reduces the attack surface. An enabled but unused service, such as Remote Desktop Protocol (RDP) on TCP/3389, is a common vector for brute-force attacks and exploits (e.g., BlueKeep, CVE-2019-0708). Disabling it eliminates this risk without affecting legitimate operations.

Answer

Keep the service enabled in case someone needs it later

Answer

Change the server name to make it harder to find

Answer

Increase disk space on the server

Question 13

A help desk team needs to reset passwords on servers during incidents, but they should not keep standing administrator rights all day. Which two controls best support this requirement? Select two.

Accepted Answer

Use privileged access management (PAM) to control and audit elevated access.. Privileged Access Management (PAM) solutions enforce just-in-time (JIT) elevation, time-bound access, and session auditing. This allows the help desk team to obtain administrator rights only when needed for incident response, eliminating the need for standing admin rights while maintaining full audit trails.

Answer

Share one permanent domain administrator account with the whole team.

Answer

Use a regular user account and disable all authentication logging.

Answer

Give every help desk user full access all the time so work is faster.

Question 14

Employees need to sign in once to the corporate portal and then access email and the HR app without entering credentials again. Which two technologies make this possible in a secure design? Select two.

Accepted Answer

Single sign-on (SSO).. Single sign-on (SSO) allows a user to authenticate once and then access multiple applications (email, HR app) without re-entering credentials. This is achieved by the identity provider (IdP) issuing a token (e.g., SAML assertion, OIDC ID token) that is trusted by the service providers. SSO reduces password fatigue and centralizes authentication, but must be paired with federation to securely share identity across different domains or applications.

Answer

Network address translation (NAT).

Answer

Port address translation (PAT).

Answer

A hardened BIOS password on each workstation.

Question 15

A contractor signs in to a project portal that fronts several SaaS tools. Access must be granted only if all of the following are true: the user is assigned to the project, the device is managed, and the request occurs during the approved maintenance window. Which access model best supports this requirement?

Accepted Answer

Attribute-based access control because multiple runtime attributes determine access. Attribute-based access control (ABAC) evaluates multiple runtime attributes—such as user-project assignment, device management status, and time of request—against policies to grant access. This matches the requirement because all three conditions must be true simultaneously, and ABAC can combine subject, resource, and environment attributes in a single policy rule. Role-based access control (RBAC) would only check the user's role, not device or time attributes.

Answer

Role-based access control because the contractor has one project role

Answer

Single sign-on because the user should not log in more than once

Answer

Privileged access management because the contractor needs temporary access