SY0-701 Security Architecture Practice Test 14 — 15 Questions

Question 1

A customer portal runs from a primary data center. Management wants the secondary site to take over within minutes if the primary site loses power, and the secondary site should already have current systems and data ready to serve users. Which design best fits this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A hot site with synchronized data replication and automated failover. A hot site with synchronized data replication and automated failover is the correct choice because it maintains an exact, real-time copy of systems and data at the secondary site. Synchronous replication ensures zero data loss (RPO=0), and automated failover enables the secondary site to become operational within minutes (RTO measured in minutes), meeting the requirement for immediate takeover after a power loss at the primary site.

Answer

A cold site with nightly backups stored offsite

Answer

RAID 0 across two storage arrays in the primary data center

Answer

A single backup server with larger disks and more memory

Question 2

Employees sign in once to the corporate portal and then open email, the ticketing system, and an HR application without entering credentials again. The external SaaS providers should trust the company's identity provider rather than creating separate user databases. What architecture is being used?

Accepted Answer

Federation with single sign-on using the corporate identity provider. This scenario describes federation with single sign-on (SSO), where the corporate identity provider (IdP) authenticates the user once and issues a security token (e.g., SAML assertion or OIDC token) that external SaaS providers trust. This eliminates the need for separate user databases in each application and allows seamless access across multiple services without re-entering credentials.

Answer

Local authentication on each application with synchronized passwords

Answer

Network access control using 802.1X authentication

Answer

Role-based access control on the file server

Question 3

Based on the exhibit, which change would best reduce the attack surface of the public web server while preserving remote administration from the internal network?

Accepted Answer

Move WEB01 into a DMZ and allow only the reverse proxy or load balancer to reach it on HTTPS, with admin access limited to the jump host.. Moving WEB01 into a DMZ and restricting inbound HTTPS traffic to only the reverse proxy or load balancer minimizes the server's exposure to the internet while still allowing external users to access the web application. Admin access from the internal network is preserved by limiting it to a jump host, which provides a controlled, audited entry point. This architecture follows the principle of least privilege and network segmentation, reducing the attack surface without sacrificing necessary functionality.

Answer

Assign WEB01 a public IP address directly and remove the firewall rules.

Answer

Place WEB01 on the same VLAN as user workstations so the firewall can inspect traffic more easily.

Answer

Keep the server where it is and add outbound web filtering to stop exploitation attempts.

Question 4

Based on the exhibit, which cloud service model best fits the application's operational and security requirements?

Accepted Answer

Platform as a Service (PaaS), because it offloads OS and runtime maintenance while preserving application control.. The exhibit shows an application that requires the organization to manage the application code and data while offloading the underlying OS, runtime, and middleware maintenance. Platform as a Service (PaaS) provides this exact split: the cloud provider handles the OS patches, runtime updates, and infrastructure scaling, while the organization retains full control over the application deployment and configuration. This matches the requirement of preserving application control without the overhead of managing the guest OS.

Answer

Infrastructure as a Service (IaaS), because it gives full control over the guest operating system.

Answer

Software as a Service (SaaS), because the organization would not need to maintain anything.

Answer

Colocation, because the team can place its own servers in a provider facility and manage everything directly.

Question 5

A company is publishing an internet-facing customer portal that must also query an internal database containing order history. Security wants to reduce the chance that a compromise of the portal exposes the database directly. Which design is the best choice?

Accepted Answer

Place the portal in a DMZ and keep the database on an internal network with firewall rules allowing only required traffic.. Placing the portal in a DMZ and keeping the database on an internal network with firewall rules that permit only required traffic (e.g., specific ports like 1433/TCP for SQL Server or 3306/TCP for MySQL) creates a defense-in-depth architecture. This design ensures that even if the web server is compromised, the attacker cannot directly access the database from the internet, as the internal network is isolated by the firewall and only allows traffic from the DMZ to the database on necessary ports.

Answer

Place the database in the same subnet as the web server and rely on host-based antivirus.

Answer

Use NAT so the internal database does not have a public IP address.

Answer

Move both systems behind a VPN and require users to authenticate before visiting the portal.

Question 6

Based on the exhibit, what is the best next control to prevent noncompliant mobile devices from accessing corporate email while still allowing IT to wipe company data from lost phones?

Accepted Answer

Enforce conditional access so only compliant MDM-enrolled devices can reach email and enable selective wipe for corporate data.. It combines conditional access policies (e.g., Azure AD Conditional Access or Intune compliance policies) to block noncompliant devices from accessing corporate email, while using MDM selective wipe to remove only corporate data (e.g., email, documents) without affecting personal data on the device. This approach enforces security without requiring a full device wipe, preserving user privacy and IT control.

Answer

Require users to set a longer password on the email app and keep the current access policy.

Answer

Disable email on all mobile devices and force users to use desktop computers only.

Answer

Rely on a remote full factory reset whenever a device is lost or reported stolen.

Question 7

A company wants all corporate laptops to authenticate to Wi-Fi using device certificates instead of shared passwords. It also wants to deny network access to systems that do not meet the baseline requirement for disk encryption and current endpoint protection. Which approach best satisfies both goals?

Accepted Answer

Deploy 802.1X with certificate-based authentication and network access control posture checks.. 802.1X with certificate-based authentication ensures that only devices with valid certificates can authenticate to the Wi-Fi network, eliminating reliance on shared passwords. Network access control (NAC) posture checks then evaluate each device against baseline requirements (e.g., disk encryption, current endpoint protection) and deny access to non-compliant systems. This combination directly satisfies both goals of certificate-only authentication and conditional access based on security posture.

Answer

Use a single WPA2-Personal passphrase and email it to all employees.

Answer

Allow any device to join and rely on antivirus scans after users log in.

Answer

Use MAC address filtering and a captive portal for all internal Wi-Fi users.

Question 8

Based on the exhibit, what is the best cloud identity control to ensure terminated users lose access to the SaaS application quickly and consistently?

Accepted Answer

Enable federated authentication with the corporate IdP and automate provisioning and deprovisioning with SCIM.. Federated authentication with a corporate identity provider (IdP) combined with SCIM (System for Cross-domain Identity Management) ensures that when a user is terminated in the IdP (e.g., Active Directory or Azure AD), the SaaS application is automatically notified via SCIM to deprovision the user account. This eliminates manual intervention and guarantees consistent, near-instant revocation of access across all federated SaaS applications.

Answer

Keep the SaaS local user accounts and require the help desk to disable them manually after each termination.

Answer

Create a shared emergency administrator account so access can be revoked by changing one password.

Answer

Require users to clear browser cookies after termination so the SaaS session expires sooner.

Question 9

A development team wants to deploy a new internal application without managing operating system patching, runtime updates, or automatic scaling. The security team still wants the company to control the application code and its data access settings. Which cloud service model best fits this need?

Accepted Answer

Platform as a Service, because the provider manages the platform and the company manages the application and data.. Platform as a Service (PaaS) is the correct choice because the provider manages the underlying platform—including OS patching, runtime updates, and automatic scaling—while the company retains control over the application code and data access settings. This aligns with the shared responsibility model where the customer is responsible for the application and data, not the infrastructure.

Answer

Infrastructure as a Service, because the company can ignore guest OS patching entirely.

Answer

Software as a Service, because the team can deploy custom application code inside the vendor portal.

Answer

On-premises hosting, because the company can still use the provider's patching tools.

Question 10

A payment processor stores full card numbers in its transaction database, but developers and analysts should never see the real numbers in nonproduction reports or troubleshooting tools. The business still needs to correlate the same card across multiple records. Which technique is the best fit?

Accepted Answer

Tokenization, because it replaces the real value with a surrogate token for business use.. Tokenization is the best fit because it replaces the full card number with a unique, non-reversible surrogate token that retains the ability to correlate records (the same card always produces the same token). This allows the business to perform analytics and troubleshooting without exposing the actual sensitive data, as the token has no mathematical relationship to the original PAN and cannot be reversed.

Answer

Hashing, because the output can always be reversed by the application later.

Answer

Data masking, because it permanently deletes the sensitive record from the database.

Answer

Compression, because reducing file size also hides the payment information from users.

Question 11

Based on the exhibit, which data protection control best allows analysts to work with the records without exposing full card numbers?

Accepted Answer

Tokenize the card numbers and keep the token mapping in a secured vault.. Tokenization replaces sensitive card numbers with non-sensitive placeholders (tokens) that retain the format and length of the original data but have no exploitable value. The analytics team can work with the tokens for reporting and analysis, while the actual card numbers remain securely stored in a separate token vault, preventing exposure even if the analytics database is compromised.

Answer

Encrypt the entire analytics database and give the team the decryption key.

Answer

Hash the card numbers with SHA-256 so the analytics team can reverse them later if needed.

Answer

Delete all but the last four digits from the production database immediately.

Question 12

A hospital has clinical workstations, badge readers, and building cameras all connected to the same switching infrastructure. After a workstation infection, the security team wants to prevent those endpoints from laterally reaching the badge readers while still allowing the cameras to report to a recording server. What should be implemented first?

Accepted Answer

Create separate VLANs and apply ACLs between device groups based on business need.. Creating separate VLANs segments the network into distinct broadcast domains, preventing workstations from directly reaching badge readers at Layer 2. Applying ACLs between VLANs then enforces granular access control, allowing only the cameras to communicate with the recording server while blocking lateral movement from infected endpoints. This aligns with the principle of least privilege and is the foundational step for network segmentation.

Answer

Increase the DHCP lease time so devices keep the same IP addresses longer.

Answer

Replace the switches with unmanaged models to simplify configuration.

Answer

Disable the cameras' encryption so the recording server can process traffic faster.

Question 13

An organization stores full payment card numbers, analysts need the last four digits for investigation, and the backup team is worried about ransomware and stolen backup media. Which three controls best address these requirements? Select three.

Accepted Answer

Tokenize primary account numbers before they reach analytics, reporting, or test systems.. Tokenization replaces the full primary account number (PAN) with a unique token that retains the last four digits for analytics, so analysts can perform investigations without exposing sensitive cardholder data. This directly satisfies PCI DSS requirements for minimizing the use of full PANs in non-production environments, while preserving the utility needed for fraud analysis or reporting.

Answer

Store backups on the same production storage array to simplify restore operations.

Answer

Use simple masking only in spreadsheets while leaving the source database unchanged.

Question 14

Based on the exhibit, which backup protection change best improves ransomware resilience and protects the backup media if it is stolen?

Accepted Answer

Add an immutable offline or air-gapped copy with separate backup credentials and regular restore testing.. Implementing an immutable, offline or air-gapped backup copy with separate credentials ensures that even if an attacker compromises the primary backup system or steals the media, they cannot modify or delete the backups. Regular restore testing verifies the integrity and recoverability of the data, which is critical for ransomware resilience. This approach aligns with the 3-2-1 backup rule and NIST SP 800-184 guidance for cyber recovery.

Answer

Enable backup encryption only, because encrypted backups cannot be read if stolen.

Answer

Move the USB drive into a different cabinet inside the same server room.

Answer

Reduce the retention period so backups consume less storage space.

Question 15

A company is evaluating a multi-tenant SaaS document platform. The security team wants to reduce the impact of another tenant’s breach and ensure employees who leave are removed from the app within minutes. Which two requirements should the team prioritize? Select two.

Accepted Answer

Require the provider to document logical tenant isolation and separate customer encryption keys.. Logical tenant isolation (e.g., separate databases or namespaces) and separate customer encryption keys ensure that a breach in one tenant cannot access another tenant's data, directly reducing the impact of cross-tenant attacks. This aligns with the shared responsibility model in SaaS, where the provider must enforce strong multi-tenant boundaries at the application and data layers.

Answer

Use a shared local administrator account for the app so offboarding is easier.

Answer

Allow anonymous public links as the default method for external collaboration.

Answer

Rely on manual quarterly cleanup tickets to disable former employees.