SY0-701 Security Architecture Practice Test 13 — 15 Questions

Question 1

A DevOps team builds container images in a CI/CD pipeline. Security wants to reduce the chance of deploying vulnerable libraries and also wants the cluster to reject images that have not been approved. Which approach best meets both requirements?

Accepted Answer

Scan images in the pipeline and enforce signature verification or admission control before deployment.. Option D is correct because it combines two essential security controls: scanning container images for known vulnerabilities (e.g., using Trivy or Clair) during the CI/CD pipeline, and enforcing signature verification (e.g., using Notary or Cosign) or admission control (e.g., using OPA/Gatekeeper or Kyverno) to ensure only signed or approved images are deployed. This directly reduces the risk of deploying vulnerable libraries and prevents unapproved images from running in the cluster.

Answer

Increase CPU and memory limits for the containers so they run more safely.

Answer

Allow developers to pull images from any registry as long as the tags look familiar.

Answer

Disable pipeline scanning to speed releases and rely on runtime monitoring after deployment.

Question 2

A customer portal runs from a primary data center. Management wants the secondary site to take over within minutes if the primary site loses power, and the secondary site should already have current systems and data ready to serve users. Which design best fits this requirement?

Accepted Answer

A hot site with synchronized data replication and automated failover. A hot site with synchronized data replication and automated failover is the correct choice because it maintains an exact, real-time copy of systems and data at the secondary site. Synchronous replication ensures zero data loss (RPO=0), and automated failover enables the secondary site to become operational within minutes (RTO measured in minutes), meeting the requirement for immediate takeover after a power loss at the primary site.

Answer

A cold site with nightly backups stored offsite

Answer

RAID 0 across two storage arrays in the primary data center

Answer

A single backup server with larger disks and more memory

Question 3

Employees sign in once to the corporate portal and then open email, the ticketing system, and an HR application without entering credentials again. The external SaaS providers should trust the company's identity provider rather than creating separate user databases. What architecture is being used?

Accepted Answer

Federation with single sign-on using the corporate identity provider. This scenario describes federation with single sign-on (SSO), where the corporate identity provider (IdP) authenticates the user once and issues a security token (e.g., SAML assertion or OIDC token) that external SaaS providers trust. This eliminates the need for separate user databases in each application and allows seamless access across multiple services without re-entering credentials.

Answer

Local authentication on each application with synchronized passwords

Answer

Network access control using 802.1X authentication

Answer

Role-based access control on the file server

Question 4

A customer portal must stay online if one application server fails. Which two design choices improve availability? Select two.

Accepted Answer

Use load balancing across multiple application servers.. Option A is correct because load balancing distributes incoming traffic across multiple application servers. If one server fails, the load balancer automatically redirects traffic to the remaining healthy servers, ensuring the portal remains online. This design eliminates a single point of failure and provides fault tolerance through redundancy.

Answer

Store the application logs on a larger disk.

Answer

Increase the password length requirement for portal users.

Answer

Place all traffic on a single high-performance server.

Question 5

An architect reviews a design where an internet-facing reverse proxy in a DMZ forwards HTTPS to a web application tier, and the web tier queries a database on a protected internal subnet. The current firewall plan allows the DMZ subnet to reach the database subnet on any TCP port, and the admins want to manage the proxy without exposing it to the user VLAN. Which two changes best improve the design? Select two.

Accepted Answer

Place the public reverse proxy in a DMZ separated from the internal network by a firewall.. Option B is correct because placing the public reverse proxy in a DMZ separated from the internal network by a firewall enforces a layered security model. The DMZ acts as a buffer zone, ensuring that even if the proxy is compromised, the attacker cannot directly access the internal web or database tiers without traversing another firewall. This aligns with defense-in-depth principles for internet-facing services.

Answer

Collapse the DMZ and internal database into the same VLAN so firewall rules are simpler.

Answer

Allow the database subnet to accept inbound connections from the internet for easier scaling.

Answer

Disable stateful inspection on the firewall so return traffic is automatically trusted.

Question 6

Based on the exhibit, which change would best reduce the attack surface of the public web server while preserving remote administration from the internal network?

Accepted Answer

Move WEB01 into a DMZ and allow only the reverse proxy or load balancer to reach it on HTTPS, with admin access limited to the jump host.. Moving WEB01 into a DMZ and restricting inbound HTTPS traffic to only the reverse proxy or load balancer minimizes the server's exposure to the internet while still allowing external users to access the web application. Admin access from the internal network is preserved by limiting it to a jump host, which provides a controlled, audited entry point. This architecture follows the principle of least privilege and network segmentation, reducing the attack surface without sacrificing necessary functionality.

Answer

Assign WEB01 a public IP address directly and remove the firewall rules.

Answer

Place WEB01 on the same VLAN as user workstations so the firewall can inspect traffic more easily.

Answer

Keep the server where it is and add outbound web filtering to stop exploitation attempts.

Question 7

Based on the exhibit, which cloud service model best fits the application's operational and security requirements?

Accepted Answer

Platform as a Service (PaaS), because it offloads OS and runtime maintenance while preserving application control.. The exhibit shows an application that requires the organization to manage the application code and data while offloading the underlying OS, runtime, and middleware maintenance. Platform as a Service (PaaS) provides this exact split: the cloud provider handles the OS patches, runtime updates, and infrastructure scaling, while the organization retains full control over the application deployment and configuration. This matches the requirement of preserving application control without the overhead of managing the guest OS.

Answer

Infrastructure as a Service (IaaS), because it gives full control over the guest operating system.

Answer

Software as a Service (SaaS), because the organization would not need to maintain anything.

Answer

Colocation, because the team can place its own servers in a provider facility and manage everything directly.

Question 8

A company is publishing an internet-facing customer portal that must also query an internal database containing order history. Security wants to reduce the chance that a compromise of the portal exposes the database directly. Which design is the best choice?

Accepted Answer

Place the portal in a DMZ and keep the database on an internal network with firewall rules allowing only required traffic.. Option B is correct because placing the portal in a DMZ and keeping the database on an internal network with firewall rules that permit only required traffic (e.g., specific ports like 1433/TCP for SQL Server or 3306/TCP for MySQL) creates a defense-in-depth architecture. This design ensures that even if the web server is compromised, the attacker cannot directly access the database from the internet, as the internal network is isolated by the firewall and only allows traffic from the DMZ to the database on necessary ports.

Answer

Place the database in the same subnet as the web server and rely on host-based antivirus.

Answer

Use NAT so the internal database does not have a public IP address.

Answer

Move both systems behind a VPN and require users to authenticate before visiting the portal.

Question 9

Based on the exhibit, what is the best next control to prevent noncompliant mobile devices from accessing corporate email while still allowing IT to wipe company data from lost phones?

Accepted Answer

Enforce conditional access so only compliant MDM-enrolled devices can reach email and enable selective wipe for corporate data.. Option A is correct because it combines conditional access policies (e.g., Azure AD Conditional Access or Intune compliance policies) to block noncompliant devices from accessing corporate email, while using MDM selective wipe to remove only corporate data (e.g., email, documents) without affecting personal data on the device. This approach enforces security without requiring a full device wipe, preserving user privacy and IT control.

Answer

Require users to set a longer password on the email app and keep the current access policy.

Answer

Disable email on all mobile devices and force users to use desktop computers only.

Answer

Rely on a remote full factory reset whenever a device is lost or reported stolen.

Question 10

A company wants all corporate laptops to authenticate to Wi-Fi using device certificates instead of shared passwords. It also wants to deny network access to systems that do not meet the baseline requirement for disk encryption and current endpoint protection. Which approach best satisfies both goals?

Accepted Answer

Deploy 802.1X with certificate-based authentication and network access control posture checks.. 802.1X with certificate-based authentication ensures that only devices with valid certificates can authenticate to the Wi-Fi network, eliminating reliance on shared passwords. Network access control (NAC) posture checks then evaluate each device against baseline requirements (e.g., disk encryption, current endpoint protection) and deny access to non-compliant systems. This combination directly satisfies both goals of certificate-only authentication and conditional access based on security posture.

Answer

Use a single WPA2-Personal passphrase and email it to all employees.

Answer

Allow any device to join and rely on antivirus scans after users log in.

Answer

Use MAC address filtering and a captive portal for all internal Wi-Fi users.

Question 11

Based on the exhibit, what is the best cloud identity control to ensure terminated users lose access to the SaaS application quickly and consistently?

Accepted Answer

Enable federated authentication with the corporate IdP and automate provisioning and deprovisioning with SCIM.. Option B is correct because federated authentication with a corporate identity provider (IdP) combined with SCIM (System for Cross-domain Identity Management) ensures that when a user is terminated in the IdP (e.g., Active Directory or Azure AD), the SaaS application is automatically notified via SCIM to deprovision the user account. This eliminates manual intervention and guarantees consistent, near-instant revocation of access across all federated SaaS applications.

Answer

Keep the SaaS local user accounts and require the help desk to disable them manually after each termination.

Answer

Create a shared emergency administrator account so access can be revoked by changing one password.

Answer

Require users to clear browser cookies after termination so the SaaS session expires sooner.

Question 12

A development team wants to deploy a new internal application without managing operating system patching, runtime updates, or automatic scaling. The security team still wants the company to control the application code and its data access settings. Which cloud service model best fits this need?

Accepted Answer

Platform as a Service, because the provider manages the platform and the company manages the application and data.. Platform as a Service (PaaS) is the correct choice because the provider manages the underlying platform—including OS patching, runtime updates, and automatic scaling—while the company retains control over the application code and data access settings. This aligns with the shared responsibility model where the customer is responsible for the application and data, not the infrastructure.

Answer

Infrastructure as a Service, because the company can ignore guest OS patching entirely.

Answer

Software as a Service, because the team can deploy custom application code inside the vendor portal.

Answer

On-premises hosting, because the company can still use the provider's patching tools.

Question 13

A payment processor stores full card numbers in its transaction database, but developers and analysts should never see the real numbers in nonproduction reports or troubleshooting tools. The business still needs to correlate the same card across multiple records. Which technique is the best fit?

Accepted Answer

Tokenization, because it replaces the real value with a surrogate token for business use.. Tokenization is the best fit because it replaces the full card number with a unique, non-reversible surrogate token that retains the ability to correlate records (the same card always produces the same token). This allows the business to perform analytics and troubleshooting without exposing the actual sensitive data, as the token has no mathematical relationship to the original PAN and cannot be reversed.

Answer

Hashing, because the output can always be reversed by the application later.

Answer

Data masking, because it permanently deletes the sensitive record from the database.

Answer

Compression, because reducing file size also hides the payment information from users.

Question 14

Based on the exhibit, which data protection control best allows analysts to work with the records without exposing full card numbers?

Accepted Answer

Tokenize the card numbers and keep the token mapping in a secured vault.. Tokenization replaces sensitive card numbers with non-sensitive placeholders (tokens) that retain the format and length of the original data but have no exploitable value. The analytics team can work with the tokens for reporting and analysis, while the actual card numbers remain securely stored in a separate token vault, preventing exposure even if the analytics database is compromised.

Answer

Encrypt the entire analytics database and give the team the decryption key.

Answer

Hash the card numbers with SHA-256 so the analytics team can reverse them later if needed.

Answer

Delete all but the last four digits from the production database immediately.

Question 15

A hospital has clinical workstations, badge readers, and building cameras all connected to the same switching infrastructure. After a workstation infection, the security team wants to prevent those endpoints from laterally reaching the badge readers while still allowing the cameras to report to a recording server. What should be implemented first?

Accepted Answer

Create separate VLANs and apply ACLs between device groups based on business need.. Creating separate VLANs segments the network into distinct broadcast domains, preventing workstations from directly reaching badge readers at Layer 2. Applying ACLs between VLANs then enforces granular access control, allowing only the cameras to communicate with the recording server while blocking lateral movement from infected endpoints. This aligns with the principle of least privilege and is the foundational step for network segmentation.

Answer

Increase the DHCP lease time so devices keep the same IP addresses longer.

Answer

Replace the switches with unmanaged models to simplify configuration.

Answer

Disable the cameras' encryption so the recording server can process traffic faster.