SY0-701 Security Architecture Practice Test 12 — 15 Questions

Question 1

A company is redesigning a customer portal. Internet users must reach only the web tier, the application tier must be reachable only from the web tier, and the database must be reachable only from the application tier. Administrators should manage servers from a dedicated jump host. Which design best meets these requirements?

Accepted Answer

Place web servers in a DMZ, application servers in an internal server subnet, databases in a restricted trust zone, and allow administration only through ACLs from a jump host.. Option B correctly implements a layered security architecture by placing web servers in a DMZ (accessible from the internet), application servers in an internal subnet (accessible only from the DMZ), and databases in a restricted trust zone (accessible only from the application tier). Administration is restricted to a dedicated jump host, enforcing strict network segmentation and least-privilege access control via ACLs.

Answer

Place all servers on one VLAN and use host firewalls on each system.

Answer

Place the database servers in the DMZ so the web tier can query them directly from the internet-facing network.

Answer

Use NAT for all servers and keep every system on the same internal subnet to simplify routing.

Question 2

An HR assistant should be able to view employee records, but should not have access to payroll administration or IT server tools. Which access model is best for assigning permissions by job role?

Accepted Answer

Role-based access control. Role-based access control (RBAC) is the correct model because it assigns permissions based on job functions rather than individual users. In this scenario, the HR assistant role would be granted read/write access to employee records, while being explicitly denied access to payroll administration and IT server tools, ensuring least privilege and separation of duties. RBAC simplifies administration by grouping permissions into roles, which can be easily assigned or revoked as job responsibilities change.

Answer

Shared local administrator accounts

Answer

Open access for all employees

Answer

Biometric authentication

Question 3

A Windows file server was built from a gold image, but six months later a scan shows Remote Desktop enabled, SMBv1 re-enabled, and Print Spooler running. The same drift appears on several other servers after emergency troubleshooting. Security wants to return the environment to the approved baseline and prevent the changes from coming back. What is the best solution?

Accepted Answer

Deploy configuration management that enforces the hardened baseline continuously. Configuration management tools like Ansible, DSC, or Group Policy can continuously enforce a hardened baseline by reverting unauthorized changes (e.g., disabling SMBv1, stopping Print Spooler, disabling RDP) at a defined interval or on a trigger. This prevents configuration drift without relying on manual intervention or reactive scanning, directly addressing the root cause of the problem.

Answer

Document the deviations and rely on manual checks after each maintenance window

Answer

Run a vulnerability scan more often and close the findings in the ticketing system

Answer

Increase storage capacity so the image can be rebuilt faster next time

Question 4

An HR department wants each employee to access only the systems required for their job. A new hire should receive the same permissions as other HR specialists, and changes to the role should update access centrally. Which access model should be used?

Accepted Answer

Role-based access control (RBAC). Role-based access control (RBAC) is the correct model because it assigns permissions based on job roles (e.g., HR specialist), ensuring that a new hire automatically inherits the same access as others in that role. Centralized role management allows changes to the role's permissions to propagate to all members, meeting the requirement for centralized updates.

Answer

Attribute-based access control (ABAC)

Answer

Multi-factor authentication (MFA)

Answer

Privileged access management (PAM)

Question 5

A system administrator is creating a secure baseline for a new Linux application server. Which two actions are appropriate hardening steps? Select two.

Accepted Answer

Disable services that the server does not need to perform its job.. Disabling unnecessary services reduces the attack surface by removing potential entry points for exploitation. In a Linux server baseline, services like Telnet, FTP, or unused web servers should be disabled using systemctl or by removing the associated packages. This aligns with the principle of least functionality, ensuring only required processes run.

Answer

Install extra administrative tools on the server for convenience.

Answer

Enable passwordless remote shell access for faster troubleshooting.

Answer

Leave sample accounts and default demo content in place for testing.

Question 6

A legacy finance application cannot yet support multifactor authentication. The security team still wants administrators to use separate privileged accounts, receive elevated access only when a ticket is approved, and have those privileges removed automatically after the maintenance window ends. Which solution best fits?

Accepted Answer

Use privileged access management with separate admin accounts and time-bound elevation approvals.. Option C is correct because Privileged Access Management (PAM) solutions are specifically designed to enforce just-in-time (JIT) privileged access. They allow administrators to request time-bound elevation of rights for a specific maintenance window, with automatic revocation after the window expires. This directly meets the requirements of separate privileged accounts, ticket-based approval, and automatic removal of privileges, even when the legacy application itself cannot support MFA.

Answer

Create one shared administrator account and rotate its password every week.

Answer

Assign permanent administrator rights through role-based access control and rely on audit logs afterward.

Answer

Move the application behind a federation service so all users can sign in with a single password.

Question 7

A router interface connects the DMZ subnet 10.10.10.0/24 to the internal network. A web server at 10.10.10.25 must reach an application server at 10.10.20.20 on TCP 8443, and all other DMZ-to-internal traffic must be blocked. Which two ACL entries should be applied inbound on the DMZ-facing interface? Select two.

Accepted Answer

permit tcp 10.10.10.25 host 10.10.20.20 eq 8443. Option A is correct because it permits TCP traffic from the specific web server (10.10.10.25) to the application server (10.10.20.20) on destination port 8443, which is the only allowed DMZ-to-internal communication. This entry uses the 'host' keyword to specify the exact source IP and the 'eq' keyword to match the required destination port, implementing the principle of least privilege.

Answer

permit tcp host 10.10.20.20 any eq 8443

Answer

permit ip any any

Answer

permit udp 10.10.10.0/24 host 10.10.20.20 eq 8443

Question 8

A customer-facing website must stay available if one of two application servers fails. Which design should the team implement?

Accepted Answer

A load balancer in front of multiple application servers. A load balancer distributes incoming traffic across multiple application servers, providing high availability and fault tolerance. If one server fails, the load balancer automatically redirects traffic to the remaining healthy server(s), ensuring the website remains accessible. This design directly addresses the requirement for continued availability despite a single server failure.

Answer

A single server with a larger power supply

Answer

A daily screenshot of the website

Answer

A more restrictive password policy

Question 9

A DevOps team stores container images in a registry before deployment. Which two practices reduce the chance of deploying a risky image? Select two.

Accepted Answer

Scan images for known vulnerabilities before they are promoted to production.. Option A is correct because scanning container images for known vulnerabilities (e.g., using tools like Trivy or Clair) identifies CVEs in the OS packages or application dependencies before the image reaches production. This proactive check prevents deploying images with exploitable flaws, aligning with secure software supply chain practices. Option B is correct because using trusted minimal base images (e.g., Alpine or distroless) reduces the attack surface, and removing unnecessary packages eliminates potential vulnerabilities from unused components, following the principle of least functionality.

Answer

Run containers as root by default to simplify troubleshooting.

Answer

Mount the host operating system filesystem into every container.

Answer

Deploy images using the latest tag without reviewing version history.

Question 10

A Linux server is being prepared for production as a database host. The build team notices that a graphical desktop environment, an unused FTP service, and an open mail submission port are present on the image, even though none of them are required. The organization wants future builds to be consistent and easy to verify. What is the best approach?

Accepted Answer

Create and enforce a hardened build standard that removes unnecessary services and ports, then validate future servers against it.. Option C is correct because it establishes a hardened baseline configuration that removes unnecessary services (e.g., FTP on port 21) and closes unused ports (e.g., mail submission port 587), ensuring consistency and simplifying verification. This aligns with the principle of minimizing attack surface by disabling all non-essential components before production deployment. A hardened build standard also enables automated compliance checks (e.g., using CIS benchmarks or OpenSCAP) to validate future servers against the defined secure state.

Answer

Leave the image unchanged so troubleshooting remains easier for administrators.

Answer

Use the image only for development and skip security review for production.

Answer

Add another firewall rule set and keep every installed service in place.

Question 11

A company is placing its public web server so internet users can reach it, but the database server must stay hidden from the internet and be reachable only by the web server. Which design best supports this goal?

Accepted Answer

Place the web server in a DMZ and keep the database server on the internal network. Option B is correct because it uses a DMZ (demilitarized zone) to isolate the public-facing web server from the internal network. The web server in the DMZ is accessible from the internet, while the database server remains on the internal network, reachable only by the web server through a firewall rule that permits traffic on the specific database port (e.g., TCP 3306 for MySQL). This layered security design prevents direct internet access to sensitive data.

Answer

Put both servers on the same flat internal network

Answer

Put the database server in the DMZ and the web server on the internal network

Answer

Disable the firewall so the web server can communicate freely with all hosts

Question 12

In a virtualized environment, several workloads share the same physical host and the same IP subnet. After one payroll VM is compromised, the security team wants to prevent that VM from freely scanning or reaching the other workloads on the host. Which control best addresses this lateral-movement risk?

Accepted Answer

Microsegmentation with policy rules applied per workload or per VM. Microsegmentation allows granular security policies to be applied per workload or per VM, even within the same subnet and on the same hypervisor. By enforcing firewall rules at the virtual switch or hypervisor level, it prevents a compromised payroll VM from scanning or communicating laterally with other VMs on the same host, directly addressing the lateral-movement risk.

Answer

Expanding the subnet mask so all workloads are easier to reach

Answer

Creating a shared administrator account for all virtual machines

Answer

Disabling DHCP and forcing every VM to use a static IP address

Question 13

A stateless firewall sits between a DMZ subnet 10.10.10.0/24 and an internal subnet 10.10.20.0/24. Only the web server at 10.10.10.25 should be allowed to initiate TCP sessions to the app server at 10.10.20.20 on port 8443. All other DMZ-to-internal traffic must remain blocked. Which ACL entry is the best fit on the DMZ-facing interface?

Accepted Answer

permit tcp host 10.10.10.25 host 10.10.20.20 eq 8443 followed by deny ip any any. Option B is correct because it explicitly permits only the web server at 10.10.10.25 to initiate TCP sessions to the app server at 10.10.20.20 on port 8443, then denies all other traffic. Since the firewall is stateless, it cannot track session state, so the ACL must be applied on the DMZ-facing interface to control outbound-initiated traffic from the DMZ to the internal subnet. The permit statement uses the 'host' keyword for precise source and destination, followed by an explicit deny all to block any other DMZ-to-internal traffic.

Answer

deny tcp 10.10.10.0/24 10.10.20.0/24 eq 8443 followed by permit ip any any

Answer

permit tcp host 10.10.20.20 host 10.10.10.25 eq 8443 followed by deny ip any any

Answer

permit ip 10.10.10.0/24 10.10.20.0/24 followed by deny ip any any

Question 14

A security team wants to verify that a server has not drifted from its approved hardened configuration after several months of changes. Which two actions help most? Select two.

Accepted Answer

Compare the current configuration against the approved baseline.. Comparing the current configuration against the approved baseline (Option A) is a direct method to identify any deviations from the hardened state. This process, often performed manually or with scripts, checks each setting against the known-good values defined in the baseline document, such as those from CIS Benchmarks or DISA STIGs. It is the most straightforward way to detect drift after months of changes.

Answer

Restart the server and wait for users to report problems.

Answer

Increase the storage capacity on the server.

Answer

Change the desktop wallpaper to remind users of the policy.

Question 15

A contractor signs in to a project portal that integrates several SaaS apps. Access should be granted only while the user is on a managed device, assigned to the project, and using a fresh second factor. The business also wants the contractor to avoid separate logins to each app. Which three controls best fit this design? Select three.

Accepted Answer

Use federation or SSO so the identity provider issues the session for all approved apps.. Option A is correct because federation or SSO allows the identity provider to issue a single session token (e.g., SAML assertion or OIDC ID token) that is accepted by all integrated SaaS apps. This eliminates the need for separate logins, directly meeting the requirement to avoid multiple authentication prompts while maintaining centralized session control.

Answer

Create a shared project account so access can be revoked by changing one password.

Answer

Issue long-lived refresh tokens that never expire unless the user reports a problem.