SY0-701 Security Architecture Practice Test 14 — 15 Questions

Question 1

An office is replacing WPA2-PSK. The new design must ensure only company-managed laptops can join the wireless network, and any device that falls out of compliance must be blocked or quarantined until remediated. Which two controls best meet the requirement? Select two.

Accepted Answer

Deploy 802.1X with EAP-TLS so devices prove possession of a unique certificate.. 802.1X with EAP-TLS is correct because it requires each device to present a unique client certificate issued by the company's PKI. This ensures only company-managed laptops (which have the certificate) can authenticate, and it ties directly into the requirement for device-specific identity rather than a shared secret.

Answer

Use a single WPA3-Personal passphrase printed in the lobby for all managed devices.

Answer

Rely on MAC address allow lists because they cannot be forged easily.

Answer

Hide the SSID and disable client isolation to reduce discovery by attackers.

Question 2

An organization stores full payment card numbers, analysts need the last four digits for investigation, and the backup team is worried about ransomware and stolen backup media. Which three controls best address these requirements? Select three.

Accepted Answer

Tokenize primary account numbers before they reach analytics, reporting, or test systems.. Tokenization replaces the full primary account number (PAN) with a unique token that retains the last four digits for analytics, so analysts can perform investigations without exposing sensitive cardholder data. This directly satisfies PCI DSS requirements for minimizing the use of full PANs in non-production environments, while preserving the utility needed for fraud analysis or reporting.

Answer

Store backups on the same production storage array to simplify restore operations.

Answer

Use simple masking only in spreadsheets while leaving the source database unchanged.

Question 3

Based on the exhibit, which backup protection change best improves ransomware resilience and protects the backup media if it is stolen?

Accepted Answer

Add an immutable offline or air-gapped copy with separate backup credentials and regular restore testing.. Option B is correct because implementing an immutable, offline or air-gapped backup copy with separate credentials ensures that even if an attacker compromises the primary backup system or steals the media, they cannot modify or delete the backups. Regular restore testing verifies the integrity and recoverability of the data, which is critical for ransomware resilience. This approach aligns with the 3-2-1 backup rule and NIST SP 800-184 guidance for cyber recovery.

Answer

Enable backup encryption only, because encrypted backups cannot be read if stolen.

Answer

Move the USB drive into a different cabinet inside the same server room.

Answer

Reduce the retention period so backups consume less storage space.

Question 4

A company is evaluating a multi-tenant SaaS document platform. The security team wants to reduce the impact of another tenant’s breach and ensure employees who leave are removed from the app within minutes. Which two requirements should the team prioritize? Select two.

Accepted Answer

Require the provider to document logical tenant isolation and separate customer encryption keys.. Option A is correct because logical tenant isolation (e.g., separate databases or namespaces) and separate customer encryption keys ensure that a breach in one tenant cannot access another tenant's data, directly reducing the impact of cross-tenant attacks. This aligns with the shared responsibility model in SaaS, where the provider must enforce strong multi-tenant boundaries at the application and data layers.

Answer

Use a shared local administrator account for the app so offboarding is easier.

Answer

Allow anonymous public links as the default method for external collaboration.

Answer

Rely on manual quarterly cleanup tickets to disable former employees.

Question 5

A company is concerned about ransomware and insider tampering with backups. It wants daily restore points, monthly archives, and protection if a backup drive is stolen from the storage room. Which backup design is the best answer?

Accepted Answer

Use encrypted, immutable backups with an offline or offsite copy and defined retention periods.. Option B is correct because encrypted, immutable backups prevent ransomware from encrypting or modifying backup data, and an offline or offsite copy protects against physical theft of the backup drive. Defined retention periods satisfy the daily restore points and monthly archives requirement, while immutability ensures backup integrity even if an attacker gains access to the backup system.

Answer

Store all backups on a shared file server so administrators can restore them quickly.

Answer

Keep only the most recent snapshot to reduce storage cost and simplify recovery.

Answer

Rely on RAID mirroring because it automatically creates a secure archival copy.

Question 6

A company uses a third-party expense application and wants employees to sign in with their corporate identity once, then automatically lose access in the expense app when they are terminated in the HR system. Which solution best meets both requirements?

Accepted Answer

Implement federated single sign-on and automated user provisioning and deprovisioning.. Federated single sign-on (SSO) allows users to authenticate once using their corporate identity (e.g., via SAML or OIDC), and automated provisioning/deprovisioning (often via SCIM) ensures that when an employee is terminated in the HR system, their access to the expense app is automatically revoked. This meets both requirements: seamless sign-in and immediate loss of access upon termination.

Answer

Create separate local usernames in the expense app and synchronize passwords weekly.

Answer

Require a VPN connection before users can open the expense app.

Answer

Use a shared generic account for all employees and rotate the password monthly.

Question 7

Based on the exhibit, which wireless security change best addresses both unauthorized device access and the risk of a lost laptop connecting to corporate resources?

Accepted Answer

Move the SSID to WPA2-Enterprise or WPA3-Enterprise with 802.1X, device certificates, and MDM-based compliance checks.. Option B is correct because WPA2-Enterprise or WPA3-Enterprise with 802.1X, device certificates, and MDM-based compliance checks provides mutual authentication and per-user, per-session encryption. This eliminates the risk of a lost laptop connecting to corporate resources (since device certificates can be revoked) and prevents unauthorized device access through certificate-based authentication and MDM compliance enforcement, unlike shared PSK which cannot be individually revoked.

Answer

Increase the PSK length and rotate it every 30 days.

Answer

Hide the SSID and enable MAC address filtering on the access points.

Answer

Keep the current wireless design and rely on a VPN client for all remote access.

Question 8

Based on the exhibit, which network redesign would best limit lateral movement between user endpoints and building systems after a workstation compromise?

Accepted Answer

Separate workstations, phones, badge readers, and cameras into different VLANs with ACLs or firewall rules between them.. Option B is correct because segmenting workstations, phones, badge readers, and cameras into separate VLANs with ACLs or firewall rules between them enforces micro-segmentation. This prevents a compromised workstation from directly initiating lateral movement to building systems (e.g., cameras or badge readers) by restricting inter-VLAN traffic at Layer 3/4, limiting the blast radius of an attack.

Answer

Move every device into a single flat subnet so internal routing is simpler.

Answer

Keep the design unchanged and rely on antivirus on the workstations to block access to the cameras.

Answer

Put all traffic through the guest Wi-Fi VLAN to isolate it from the corporate network.

Question 9

Sales representatives use company-managed smartphones for email, CRM, and document access. If a phone is lost, IT must remove only the corporate apps and work data without erasing the employee's personal photos and contacts. Which control should be used?

Accepted Answer

Use selective wipe through a mobile device management platform.. Option B is correct because Mobile Device Management (MDM) platforms support selective wipe, which uses management APIs (e.g., Android Enterprise Work Profile or iOS Managed Open In) to remove only corporate apps, accounts, and data while leaving personal content intact. This satisfies the requirement to protect corporate data without infringing on the employee's personal privacy.

Answer

Perform a full factory reset remotely as soon as any device is reported lost.

Answer

Disable password complexity so the user can regain access more easily after replacement.

Answer

Install a VPN profile and assume corporate data is safe if the network traffic is encrypted.

Question 10

A platform team runs production, staging, and developer containers on the same Kubernetes cluster. After a staging compromise, the team wants to reduce the chance of access to production secrets or lateral movement to other namespaces. Which two architecture changes are most effective? Select two.

Accepted Answer

Move production workloads into a separate cluster or dedicated node pool with stricter tenancy boundaries.. Option A is correct because moving production workloads to a separate cluster or dedicated node pool enforces stronger tenancy boundaries, preventing a compromise in staging from directly accessing production secrets or pods. Kubernetes namespaces alone do not provide strong isolation, as a single cluster shares the same control plane and node resources, making lateral movement possible. This architectural change reduces the attack surface by physically or logically separating production from staging and development environments.

Answer

Run all namespaces on the same privileged worker nodes so scaling is easier.

Answer

Store secrets as plain environment variables because container images are already isolated.

Answer

Grant every service account cluster-admin so deployments fail less often.

Question 11

A team is deploying a containerized API to a public cloud. The service must be reachable only by internal corporate applications, and secrets must not be embedded in images or readable as plaintext by administrators of the underlying host. Which two actions best fit the design? Select two.

Accepted Answer

Place the API in a private subnet and expose it only through an internal load balancer or private endpoint.. Option A is correct because placing the API in a private subnet and exposing it only through an internal load balancer or private endpoint ensures that the service is reachable only by internal corporate applications, as traffic never traverses the public internet. This design leverages network segmentation and private IP addressing to enforce access control at the network layer, aligning with the requirement for internal-only reachability.

Answer

Give each container a public IP and restrict access by source IP allowlist.

Answer

Bake database passwords into the container image so deployment is simpler.

Answer

Assume the cloud provider's tenant isolation alone is enough to protect secrets from misuse.

Question 12

A payment application must keep running if one application server fails, and the business can tolerate no more than 5 minutes of lost transactions and 30 minutes of downtime during a site outage. Which two controls best match the availability requirements? Select two.

Accepted Answer

Deploy at least two active application nodes behind a load balancer so one server failure does not interrupt service.. Option A is correct because deploying at least two active application nodes behind a load balancer ensures that if one server fails, traffic is automatically redirected to the remaining healthy node(s), achieving zero downtime for the application itself. This directly meets the requirement that the payment application must keep running if one application server fails, without any interruption to service.

Answer

Use a cold site that is powered off until a disaster is declared.

Answer

Take nightly backups to meet the 5-minute recovery point objective.

Answer

Rely on weekly VM snapshots because they are faster than replication.

Question 13

A company is redesigning a three-tier customer portal. Internet users must reach only the web tier, the application tier must never be directly reachable from the internet, database traffic must flow only from the app tier, and administrators need a protected path to manage servers. Which two design choices best meet these requirements? Select two.

Accepted Answer

Place the public web tier in a DMZ behind a reverse proxy or WAF so the internet never reaches application or database hosts directly.. Option A is correct because placing the public web tier in a DMZ behind a reverse proxy or WAF ensures that internet traffic is terminated at the proxy layer, which inspects and filters requests before forwarding them to the web servers. This architecture prevents direct internet access to the application or database tiers, enforcing the required isolation. The reverse proxy or WAF can also provide SSL/TLS termination, load balancing, and application-layer attack mitigation, aligning with the principle of defense in depth.

Answer

Put all three tiers on the same VLAN and depend on host-based firewalls to separate them.

Answer

Allow administrators to SSH or RDP from the standard employee VLAN for faster troubleshooting.

Answer

Expose the database listener to the internet and require strong passwords for application connections.

Question 14

An operations team manages Linux servers over SSH. The security team wants to stop direct management access from employee laptops, reduce lateral movement if one admin endpoint is compromised, and keep a log of every administrative session. Which two design choices best fit? Select two.

Accepted Answer

Require administrators to connect to a bastion host or jump server before reaching the Linux servers.. Option A is correct because a bastion host (jump server) acts as a single, hardened entry point that administrators must connect to before reaching internal Linux servers. This eliminates direct SSH access from employee laptops, reducing the attack surface and preventing lateral movement if an admin endpoint is compromised. The bastion host can also enforce centralized logging of all administrative sessions, meeting the security team's requirement for session recording.

Answer

Let all corporate laptops connect directly to SSH on the servers if MFA is enabled.

Answer

Expose SSH to the internet because key-based authentication is already strong.

Answer

Use split tunneling for admin traffic so management packets can bypass the VPN.

Question 15

A company distributes update packages through a web portal. Users must verify the portal's identity over the network, and the downloaded packages must be trusted even if the web server is later compromised. Which two controls best satisfy these goals? Select two.

Accepted Answer

Use HTTPS with a certificate from a trusted certificate authority so users can validate the portal.. HTTPS with a certificate from a trusted certificate authority (CA) allows the client to validate the web portal's identity by verifying the certificate's chain of trust and ensuring the domain name matches. This prevents man-in-the-middle attacks and confirms the server is legitimate before any data is exchanged.

Answer

Use FTP over the internet because the credentialed login keeps the transfer secure enough.

Answer

Publish a SHA-256 hash on the same download page and trust that the server will remain honest.

Answer

Use plain HTTP and rely on file permissions to protect the updates in transit.