SY0-701 Security Architecture Practice Test 12 — 15 Questions

Question 1

A team is moving an application to a cloud provider. The cloud provider will secure the physical data center and core infrastructure, while the company must still secure its own application settings and user access. What concept does this describe?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Shared responsibility model. The shared responsibility model defines the division of security obligations between a cloud provider and its customer. In this scenario, the provider secures the physical data center and core infrastructure (the 'security of the cloud'), while the company retains responsibility for application settings and user access (the 'security in the cloud'). This model is foundational to all major cloud providers, including AWS, Azure, and Google Cloud.

Answer

Fail-open design

Answer

Air gap

Answer

Data masking

Question 2

Before applying a major patch to a virtual machine, the administrator wants a quick way to return the VM to its exact pre-change state if the patch fails. What should the administrator create?

Accepted Answer

A snapshot of the virtual machine. A snapshot captures the exact state of the virtual machine (disk, memory, and power state) at a point in time, allowing the administrator to revert instantly if the patch fails. This is the fastest and most storage-efficient method for a quick rollback compared to a full backup, which is slower and more resource-intensive.

Answer

A full backup to removable media

Answer

A separate VLAN for the virtual machine

Answer

A digital certificate for the patch server

Question 3

A security team wants to know whether a workstation has drifted away from the approved hardened configuration after several months of changes. What should they use to compare the current state against the approved setup?

Accepted Answer

A configuration baseline. A configuration baseline is the approved hardened state of a system, typically captured as a snapshot of settings, registry keys, file permissions, and installed software. By comparing the current workstation state against this baseline using tools like Microsoft Security Compliance Toolkit or CIS-CAT, the team can detect drift—unauthorized changes that deviate from the secure configuration. This is the standard method for maintaining compliance and security posture over time.

Answer

A file compression tool

Answer

A password vault

Answer

A network cable tester

Question 4

A development team runs multiple customer workloads in a shared Kubernetes cluster. Security wants to reduce the risk that one compromised container can read another team's data or deploy an altered image. Which three actions best improve the design? Select three.

Accepted Answer

Require signed, scanned images from an approved registry before deployment.. Requiring signed, scanned images from an approved registry ensures that only trusted, vulnerability-free images are deployed. Image signing (e.g., using Docker Content Trust or Notary) verifies the image's integrity and origin, preventing tampered images from being deployed. Scanning catches known vulnerabilities before runtime, reducing the attack surface. This directly addresses the risk of deploying an altered image.

Answer

Run each container as root so file permissions inside the container do not block apps.

Answer

Mount the host filesystem into every pod so support staff can troubleshoot more quickly.

Question 5

A cloud support team is replacing separate logins for several internal apps. The new design must support one sign-in, reduce the chance that a stolen session remains valid too long, and let the identity team revoke access centrally after termination. Which three controls best fit? Select three.

Accepted Answer

Implement SSO through federation with the identity provider as the source of truth.. Implementing SSO through federation with the identity provider (IdP) as the source of truth allows users to sign in once and access multiple internal apps without separate logins. This design centralizes authentication, so when the identity team revokes access after termination, the IdP denies all subsequent token requests, effectively invalidating sessions across all apps. Federation typically uses SAML 2.0 or OIDC, where the IdP issues signed assertions or ID tokens that apps trust, eliminating the need for app-specific credentials.

Answer

Keep app-specific local accounts so each application can manage sessions independently.

Answer

Disable centralized logout so active sessions are never interrupted during maintenance.

Question 6

A company runs payroll and HR application servers on the same VLAN because a redesign is not possible this quarter. Security wants to reduce lateral movement if one workload is compromised, but the team cannot renumber the environment or add new physical firewalls. Which control best fits the requirement?

Accepted Answer

Implement microsegmentation with host-based or distributed firewall rules between workloads. Microsegmentation using host-based or distributed firewall rules (e.g., via a hypervisor firewall or host firewall policies) allows the security team to enforce zero-trust east-west traffic controls between the payroll and HR servers without changing the VLAN, subnet, or adding physical firewalls. This directly reduces lateral movement by restricting communication to only what is necessary, even though both workloads share the same Layer 2 broadcast domain.

Answer

Move the servers into a single larger subnet so internal routing is simplified

Answer

Place the servers behind a network address translation device to hide their IP addresses

Answer

Rely on password rotation and MFA for administrative logins only

Question 7

A company is redesigning how systems are separated in its office and data center network. Match each network design element to the scenario it best supports. Use each term once.

Accepted Answer

VLAN: Separates broadcast domains logically. VLANs separate broadcast domains, subnets divide IP networks, ACLs filter traffic, DMZs isolate public servers, VPNs provide secure remote access, and NAT translates private to public IPs.

Answer

ACL: Divides IP networks into smaller segments

Answer

NAT: Provides secure remote access over public internet

Question 8

After a server rebuild, a Windows administrator notices several unneeded services are still enabled, including Remote Registry and Print Spooler on a server that only hosts a database. What should the administrator do to reduce attack surface and keep the build consistent?

Accepted Answer

Apply the approved secure baseline and disable unnecessary services.. Applying an approved secure baseline and disabling unnecessary services (Option B) directly reduces the attack surface by removing potential entry points like Remote Registry (which allows remote modification of the registry) and Print Spooler (which has known privilege escalation vulnerabilities, e.g., CVE-2021-34527). This also ensures build consistency by enforcing a standardized configuration across all servers, which is critical for compliance and manageability in a Windows environment.

Answer

Install additional endpoint monitoring agents to compensate for the extra services.

Answer

Increase the disk encryption key size to protect the running services.

Answer

Move the server to a different subnet and leave the configuration unchanged.

Question 9

A development team stores container images in a registry before deployment. Security wants to reduce the chance of shipping vulnerable libraries or packages inside the image. What should the team do before release?

Accepted Answer

Scan the image and rebuild it from an approved base image.. Scanning the image for known vulnerabilities (CVEs) and rebuilding it from an approved, hardened base image ensures that only trusted, patched libraries and packages are included. This directly reduces the attack surface by eliminating vulnerable components before the image is deployed to production.

Answer

Run the container as root so startup problems are less likely.

Answer

Open the container port on the host firewall so the image can be reached faster.

Answer

Add more CPU and memory to the cluster to improve image security.

Question 10

A customer portal must keep serving requests if one application server stops responding. The team wants traffic to be sent to whichever healthy server is available. Which design should they implement?

Accepted Answer

A load balancer in front of multiple application servers. A load balancer distributes incoming traffic across multiple application servers and performs health checks (e.g., HTTP GET requests to a /health endpoint) to detect failures. If one server stops responding, the load balancer automatically routes requests only to the remaining healthy servers, ensuring continuous availability. This design directly meets the requirement for fault tolerance and active traffic distribution.

Answer

A RAID 1 array in the application server

Answer

A snapshot of the application server before each update

Answer

A longer password policy for the portal administrators

Question 11

A customer portal must stay online if an entire site fails, and the company must also be able to recover if data is corrupted or encrypted by ransomware. Which two design choices best satisfy both requirements? Select two.

Accepted Answer

Use active-active or automatic failover between two sites with health checks.. Active-active or automatic failover between two sites with health checks ensures that if an entire site fails, traffic is automatically redirected to the surviving site, maintaining availability. This design satisfies the first requirement of staying online during a site failure by using redundant infrastructure and health monitoring to detect and react to outages.

Answer

Keep only RAID 1 inside each server, because mirroring alone handles site outages.

Answer

Store nightly backups on the same storage array as the production data.

Answer

Replace the load balancer with a static DNS record for each server.

Question 12

Guest tablets in a conference room use the same physical switches as employee devices. The security team wants guests to have internet access only, with no route to internal subnets. Which design best meets the goal?

Accepted Answer

Place guests on a separate VLAN and block internal access with ACLs.. Placing guest tablets on a separate VLAN segments traffic at Layer 2, and applying ACLs on the Layer 3 interface (SVI or router) blocks all routes to internal subnets while permitting internet access. This design ensures that even though guests share the same physical switches, their traffic is isolated from employee VLANs and cannot reach internal resources.

Answer

Keep guests on the same VLAN and rely on a separate Wi-Fi password.

Answer

Use stronger WPA3 encryption on the wireless network and leave the network flat.

Answer

Enable MAC address filtering on the switch and allow all ports to remain in the default network.

Question 13

Employees sign in once to the company portal and then can access email, the ticketing system, and the HR site without logging in again. What is this called?

Accepted Answer

Single sign-on. Single sign-on (SSO) allows a user to authenticate once and gain access to multiple applications or systems without re-entering credentials. In this scenario, the company portal acts as the identity provider (IdP), and after initial authentication, it issues a token (e.g., SAML assertion or Kerberos ticket) that is accepted by the email, ticketing, and HR systems as proof of identity. This eliminates the need for repeated logins across these services.

Answer

Port forwarding

Answer

Tokenization

Answer

Network address translation

Question 14

A web application must be reachable from the internet, but its database should be isolated from direct internet access. Which two placements or controls are most appropriate? Select two.

Accepted Answer

Place the web server in a DMZ.. Placing the web server in a DMZ (Option A) allows it to be reachable from the internet while the internal firewall restricts inbound traffic to only necessary ports (e.g., TCP 80/443). Keeping the database on an internal network segment (Option B) and configuring firewall rules to allow traffic only from the web server’s IP address ensures the database is isolated from direct internet access, preventing external attacks on the database service.

Answer

Place both the web server and the database on the same internet-facing subnet.

Answer

Expose the database port to the internet so administrators can connect faster.

Answer

Use the guest wireless VLAN for both systems.

Question 15

A Linux operations team has a standing need to restart services and edit protected configuration files on production servers, but administrators should not keep root privileges all day. Every elevation must be approved through a ticket and logged centrally. Which solution best meets this requirement?

Accepted Answer

Use privileged access management with just-in-time elevation and session logging. Privileged Access Management (PAM) with just-in-time (JIT) elevation and session logging meets the requirement because it grants temporary, request-based root privileges that are automatically revoked after the task, and it centrally logs all commands executed during the elevated session. This ensures every elevation is approved via a ticket and auditable, without administrators retaining permanent root access.

Answer

Create one shared root password and rotate it weekly

Answer

Assign each administrator the server local administrator role permanently

Answer

Use single sign-on so administrators only authenticate once each morning