SY0-701 Security Architecture Practice Test 13 — 15 Questions

Question 1

An organization is placing its public-facing website behind a new security design. The site must be reachable from the internet, but the database and file servers must stay isolated from direct external access. What design should the architect use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a demilitarized zone (DMZ) for the public web server.. A demilitarized zone (DMZ) is a network segment that isolates public-facing services, such as a web server, from the internal network. By placing the web server in the DMZ, the organization allows internet traffic to reach the website while keeping the database and file servers on the internal network, which are not directly accessible from the internet. This design enforces a security boundary where only necessary traffic (e.g., HTTP/HTTPS) is permitted through firewall rules, preventing direct external access to sensitive backend systems.

Answer

Place the web server on the internal user subnet so it can reach the database directly.

Answer

Use a VPN concentrator so the website can be accessed securely from outside.

Answer

Use network address translation (NAT) on the web server to hide its IP address.

Question 2

A help desk team wants guest Wi-Fi users to access only the internet and nothing on the internal corporate network. Which control should the network team implement at the wireless edge?

Accepted Answer

An ACL or firewall rule set that blocks guest network access to internal subnets. To prevent guest Wi-Fi users from accessing the internal corporate network while allowing internet access, the network team must implement an ACL or firewall rule set at the wireless edge. This control explicitly blocks traffic from the guest VLAN/subnet to internal subnets (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) while permitting outbound traffic to the internet. This is a fundamental network segmentation technique that enforces the principle of least privilege at Layer 3/4.

Answer

A single shared password for all guest users

Answer

A stronger DNS server

Answer

A longer Wi-Fi passphrase rotated monthly

Question 3

A company is redesigning a customer portal. Internet users must reach only the web tier, the application tier must be reachable only from the web tier, and the database must be reachable only from the application tier. Administrators should manage servers from a dedicated jump host. Which design best meets these requirements?

Accepted Answer

Place web servers in a DMZ, application servers in an internal server subnet, databases in a restricted trust zone, and allow administration only through ACLs from a jump host.. Ly implements a layered security architecture by placing web servers in a DMZ (accessible from the internet), application servers in an internal subnet (accessible only from the DMZ), and databases in a restricted trust zone (accessible only from the application tier). Administration is restricted to a dedicated jump host, enforcing strict network segmentation and least-privilege access control via ACLs.

Answer

Place all servers on one VLAN and use host firewalls on each system.

Answer

Place the database servers in the DMZ so the web tier can query them directly from the internet-facing network.

Answer

Use NAT for all servers and keep every system on the same internal subnet to simplify routing.

Question 4

An HR assistant should be able to view employee records, but should not have access to payroll administration or IT server tools. Which access model is best for assigning permissions by job role?

Accepted Answer

Role-based access control. Role-based access control (RBAC) is the correct model because it assigns permissions based on job functions rather than individual users. In this scenario, the HR assistant role would be granted read/write access to employee records, while being explicitly denied access to payroll administration and IT server tools, ensuring least privilege and separation of duties. RBAC simplifies administration by grouping permissions into roles, which can be easily assigned or revoked as job responsibilities change.

Answer

Shared local administrator accounts

Answer

Open access for all employees

Answer

Biometric authentication

Question 5

A Windows file server was built from a gold image, but six months later a scan shows Remote Desktop enabled, SMBv1 re-enabled, and Print Spooler running. The same drift appears on several other servers after emergency troubleshooting. Security wants to return the environment to the approved baseline and prevent the changes from coming back. What is the best solution?

Accepted Answer

Deploy configuration management that enforces the hardened baseline continuously. Configuration management tools like Ansible, DSC, or Group Policy can continuously enforce a hardened baseline by reverting unauthorized changes (e.g., disabling SMBv1, stopping Print Spooler, disabling RDP) at a defined interval or on a trigger. This prevents configuration drift without relying on manual intervention or reactive scanning, directly addressing the root cause of the problem.

Answer

Document the deviations and rely on manual checks after each maintenance window

Answer

Run a vulnerability scan more often and close the findings in the ticketing system

Answer

Increase storage capacity so the image can be rebuilt faster next time

Question 6

An HR department wants each employee to access only the systems required for their job. A new hire should receive the same permissions as other HR specialists, and changes to the role should update access centrally. Which access model should be used?

Accepted Answer

Role-based access control (RBAC). Role-based access control (RBAC) is the correct model because it assigns permissions based on job roles (e.g., HR specialist), ensuring that a new hire automatically inherits the same access as others in that role. Centralized role management allows changes to the role's permissions to propagate to all members, meeting the requirement for centralized updates.

Answer

Attribute-based access control (ABAC)

Answer

Multi-factor authentication (MFA)

Answer

Privileged access management (PAM)

Question 7

A legacy finance application cannot yet support multifactor authentication. The security team still wants administrators to use separate privileged accounts, receive elevated access only when a ticket is approved, and have those privileges removed automatically after the maintenance window ends. Which solution best fits?

Accepted Answer

Use privileged access management with separate admin accounts and time-bound elevation approvals.. Privileged Access Management (PAM) solutions are specifically designed to enforce just-in-time (JIT) privileged access. They allow administrators to request time-bound elevation of rights for a specific maintenance window, with automatic revocation after the window expires. This directly meets the requirements of separate privileged accounts, ticket-based approval, and automatic removal of privileges, even when the legacy application itself cannot support MFA.

Answer

Create one shared administrator account and rotate its password every week.

Answer

Assign permanent administrator rights through role-based access control and rely on audit logs afterward.

Answer

Move the application behind a federation service so all users can sign in with a single password.

Question 8

A router interface connects the DMZ subnet 10.10.10.0/24 to the internal network. A web server at 10.10.10.25 must reach an application server at 10.10.20.20 on TCP 8443, and all other DMZ-to-internal traffic must be blocked. Which two ACL entries should be applied inbound on the DMZ-facing interface? Select two.

Accepted Answer

permit tcp 10.10.10.25 host 10.10.20.20 eq 8443. It permits TCP traffic from the specific web server (10.10.10.25) to the application server (10.10.20.20) on destination port 8443, which is the only allowed DMZ-to-internal communication. This entry uses the 'host' keyword to specify the exact source IP and the 'eq' keyword to match the required destination port, implementing the principle of least privilege.

Answer

permit tcp host 10.10.20.20 any eq 8443

Answer

permit ip any any

Answer

permit udp 10.10.10.0/24 host 10.10.20.20 eq 8443

Question 9

A customer-facing website must stay available if one of two application servers fails. Which design should the team implement?

Accepted Answer

A load balancer in front of multiple application servers. A load balancer distributes incoming traffic across multiple application servers, providing high availability and fault tolerance. If one server fails, the load balancer automatically redirects traffic to the remaining healthy server(s), ensuring the website remains accessible. This design directly addresses the requirement for continued availability despite a single server failure.

Answer

A single server with a larger power supply

Answer

A daily screenshot of the website

Answer

A more restrictive password policy

Question 10

A DevOps team stores container images in a registry before deployment. Which two practices reduce the chance of deploying a risky image? Select two.

Accepted Answer

Scan images for known vulnerabilities before they are promoted to production.. Scanning container images for known vulnerabilities (e.g., using tools like Trivy or Clair) identifies CVEs in the OS packages or application dependencies before the image reaches production. This proactive check prevents deploying images with exploitable flaws, aligning with secure software supply chain practices. Option B is correct because using trusted minimal base images (e.g., Alpine or distroless) reduces the attack surface, and removing unnecessary packages eliminates potential vulnerabilities from unused components, following the principle of least functionality.

Answer

Run containers as root by default to simplify troubleshooting.

Answer

Mount the host operating system filesystem into every container.

Answer

Deploy images using the latest tag without reviewing version history.

Question 11

A Linux server is being prepared for production as a database host. The build team notices that a graphical desktop environment, an unused FTP service, and an open mail submission port are present on the image, even though none of them are required. The organization wants future builds to be consistent and easy to verify. What is the best approach?

Accepted Answer

Create and enforce a hardened build standard that removes unnecessary services and ports, then validate future servers against it.. It establishes a hardened baseline configuration that removes unnecessary services (e.g., FTP on port 21) and closes unused ports (e.g., mail submission port 587), ensuring consistency and simplifying verification. This aligns with the principle of minimizing attack surface by disabling all non-essential components before production deployment. A hardened build standard also enables automated compliance checks (e.g., using CIS benchmarks or OpenSCAP) to validate future servers against the defined secure state.

Answer

Leave the image unchanged so troubleshooting remains easier for administrators.

Answer

Use the image only for development and skip security review for production.

Answer

Add another firewall rule set and keep every installed service in place.

Question 12

A company is placing its public web server so internet users can reach it, but the database server must stay hidden from the internet and be reachable only by the web server. Which design best supports this goal?

Accepted Answer

Place the web server in a DMZ and keep the database server on the internal network. It uses a DMZ (demilitarized zone) to isolate the public-facing web server from the internal network. The web server in the DMZ is accessible from the internet, while the database server remains on the internal network, reachable only by the web server through a firewall rule that permits traffic on the specific database port (e.g., TCP 3306 for MySQL). This layered security design prevents direct internet access to sensitive data.

Answer

Put both servers on the same flat internal network

Answer

Put the database server in the DMZ and the web server on the internal network

Answer

Disable the firewall so the web server can communicate freely with all hosts

Question 13

In a virtualized environment, several workloads share the same physical host and the same IP subnet. After one payroll VM is compromised, the security team wants to prevent that VM from freely scanning or reaching the other workloads on the host. Which control best addresses this lateral-movement risk?

Accepted Answer

Microsegmentation with policy rules applied per workload or per VM. Microsegmentation allows granular security policies to be applied per workload or per VM, even within the same subnet and on the same hypervisor. By enforcing firewall rules at the virtual switch or hypervisor level, it prevents a compromised payroll VM from scanning or communicating laterally with other VMs on the same host, directly addressing the lateral-movement risk.

Answer

Expanding the subnet mask so all workloads are easier to reach

Answer

Creating a shared administrator account for all virtual machines

Answer

Disabling DHCP and forcing every VM to use a static IP address

Question 14

A stateless firewall sits between a DMZ subnet 10.10.10.0/24 and an internal subnet 10.10.20.0/24. Only the web server at 10.10.10.25 should be allowed to initiate TCP sessions to the app server at 10.10.20.20 on port 8443. All other DMZ-to-internal traffic must remain blocked. Which ACL entry is the best fit on the DMZ-facing interface?

Accepted Answer

permit tcp host 10.10.10.25 host 10.10.20.20 eq 8443 followed by deny ip any any. It explicitly permits only the web server at 10.10.10.25 to initiate TCP sessions to the app server at 10.10.20.20 on port 8443, then denies all other traffic. Since the firewall is stateless, it cannot track session state, so the ACL must be applied on the DMZ-facing interface to control outbound-initiated traffic from the DMZ to the internal subnet. The permit statement uses the 'host' keyword for precise source and destination, followed by an explicit deny all to block any other DMZ-to-internal traffic.

Answer

deny tcp 10.10.10.0/24 10.10.20.0/24 eq 8443 followed by permit ip any any

Answer

permit tcp host 10.10.20.20 host 10.10.10.25 eq 8443 followed by deny ip any any

Answer

permit ip 10.10.10.0/24 10.10.20.0/24 followed by deny ip any any

Question 15

A DevOps team builds container images in a CI/CD pipeline. Security wants to reduce the chance of deploying vulnerable libraries and also wants the cluster to reject images that have not been approved. Which approach best meets both requirements?

Accepted Answer

Scan images in the pipeline and enforce signature verification or admission control before deployment.. It combines two essential security controls: scanning container images for known vulnerabilities (e.g., using Trivy or Clair) during the CI/CD pipeline, and enforcing signature verification (e.g., using Notary or Cosign) or admission control (e.g., using OPA/Gatekeeper or Kyverno) to ensure only signed or approved images are deployed. This directly reduces the risk of deploying vulnerable libraries and prevents unapproved images from running in the cluster.

Answer

Increase CPU and memory limits for the containers so they run more safely.

Answer

Allow developers to pull images from any registry as long as the tags look familiar.

Answer

Disable pipeline scanning to speed releases and rely on runtime monitoring after deployment.