SY0-701 Security Architecture Practice Test 15 — 15 Questions

Question 1

A company is concerned about ransomware and insider tampering with backups. It wants daily restore points, monthly archives, and protection if a backup drive is stolen from the storage room. Which backup design is the best answer?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use encrypted, immutable backups with an offline or offsite copy and defined retention periods.. Encrypted, immutable backups prevent ransomware from encrypting or modifying backup data, and an offline or offsite copy protects against physical theft of the backup drive. Defined retention periods satisfy the daily restore points and monthly archives requirement, while immutability ensures backup integrity even if an attacker gains access to the backup system.

Answer

Store all backups on a shared file server so administrators can restore them quickly.

Answer

Keep only the most recent snapshot to reduce storage cost and simplify recovery.

Answer

Rely on RAID mirroring because it automatically creates a secure archival copy.

Question 2

A company uses a third-party expense application and wants employees to sign in with their corporate identity once, then automatically lose access in the expense app when they are terminated in the HR system. Which solution best meets both requirements?

Accepted Answer

Implement federated single sign-on and automated user provisioning and deprovisioning.. Federated single sign-on (SSO) allows users to authenticate once using their corporate identity (e.g., via SAML or OIDC), and automated provisioning/deprovisioning (often via SCIM) ensures that when an employee is terminated in the HR system, their access to the expense app is automatically revoked. This meets both requirements: seamless sign-in and immediate loss of access upon termination.

Answer

Create separate local usernames in the expense app and synchronize passwords weekly.

Answer

Require a VPN connection before users can open the expense app.

Answer

Use a shared generic account for all employees and rotate the password monthly.

Question 3

Based on the exhibit, which wireless security change best addresses both unauthorized device access and the risk of a lost laptop connecting to corporate resources?

Accepted Answer

Move the SSID to WPA2-Enterprise or WPA3-Enterprise with 802.1X, device certificates, and MDM-based compliance checks.. WPA2-Enterprise or WPA3-Enterprise with 802.1X, device certificates, and MDM-based compliance checks provides mutual authentication and per-user, per-session encryption. This eliminates the risk of a lost laptop connecting to corporate resources (since device certificates can be revoked) and prevents unauthorized device access through certificate-based authentication and MDM compliance enforcement, unlike shared PSK which cannot be individually revoked.

Answer

Increase the PSK length and rotate it every 30 days.

Answer

Hide the SSID and enable MAC address filtering on the access points.

Answer

Keep the current wireless design and rely on a VPN client for all remote access.

Question 4

Based on the exhibit, which network redesign would best limit lateral movement between user endpoints and building systems after a workstation compromise?

Accepted Answer

Separate workstations, phones, badge readers, and cameras into different VLANs with ACLs or firewall rules between them.. Segmenting workstations, phones, badge readers, and cameras into separate VLANs with ACLs or firewall rules between them enforces micro-segmentation. This prevents a compromised workstation from directly initiating lateral movement to building systems (e.g., cameras or badge readers) by restricting inter-VLAN traffic at Layer 3/4, limiting the blast radius of an attack.

Answer

Move every device into a single flat subnet so internal routing is simpler.

Answer

Keep the design unchanged and rely on antivirus on the workstations to block access to the cameras.

Answer

Put all traffic through the guest Wi-Fi VLAN to isolate it from the corporate network.

Question 5

Sales representatives use company-managed smartphones for email, CRM, and document access. If a phone is lost, IT must remove only the corporate apps and work data without erasing the employee's personal photos and contacts. Which control should be used?

Accepted Answer

Use selective wipe through a mobile device management platform.. Mobile Device Management (MDM) platforms support selective wipe, which uses management APIs (e.g., Android Enterprise Work Profile or iOS Managed Open In) to remove only corporate apps, accounts, and data while leaving personal content intact. This satisfies the requirement to protect corporate data without infringing on the employee's personal privacy.

Answer

Perform a full factory reset remotely as soon as any device is reported lost.

Answer

Disable password complexity so the user can regain access more easily after replacement.

Answer

Install a VPN profile and assume corporate data is safe if the network traffic is encrypted.

Question 6

A team is deploying a containerized API to a public cloud. The service must be reachable only by internal corporate applications, and secrets must not be embedded in images or readable as plaintext by administrators of the underlying host. Which two actions best fit the design? Select two.

Accepted Answer

Place the API in a private subnet and expose it only through an internal load balancer or private endpoint.. Placing the API in a private subnet and exposing it only through an internal load balancer or private endpoint ensures that the service is reachable only by internal corporate applications, as traffic never traverses the public internet. This design leverages network segmentation and private IP addressing to enforce access control at the network layer, aligning with the requirement for internal-only reachability.

Answer

Give each container a public IP and restrict access by source IP allowlist.

Answer

Bake database passwords into the container image so deployment is simpler.

Answer

Assume the cloud provider's tenant isolation alone is enough to protect secrets from misuse.

Question 7

An operations team manages Linux servers over SSH. The security team wants to stop direct management access from employee laptops, reduce lateral movement if one admin endpoint is compromised, and keep a log of every administrative session. Which two design choices best fit? Select two.

Accepted Answer

Require administrators to connect to a bastion host or jump server before reaching the Linux servers.. A bastion host (jump server) acts as a single, hardened entry point that administrators must connect to before reaching internal Linux servers. This eliminates direct SSH access from employee laptops, reducing the attack surface and preventing lateral movement if an admin endpoint is compromised. The bastion host can also enforce centralized logging of all administrative sessions, meeting the security team's requirement for session recording.

Answer

Let all corporate laptops connect directly to SSH on the servers if MFA is enabled.

Answer

Expose SSH to the internet because key-based authentication is already strong.

Answer

Use split tunneling for admin traffic so management packets can bypass the VPN.

Question 8

Match each design requirement to the best security architecture control. Use each control once.

Accepted Answer

Layered security: Defense in depth. Defense in depth uses layered controls, least privilege minimizes risk, separation of duties prevents fraud, fail secure avoids insecure states, secure defaults reduce misconfiguration, and complete mediation ensures consistent enforcement.

Answer

Avoid insecure state: Defense in depth

Answer

Reduce misconfiguration: Least privilege

Answer

Enforce consistently: Separation of duties

Question 9

A security architect is evaluating a zero trust architecture (ZTA) for a remote workforce. Which three of the following components are essential to the implementation? (Choose three.)

Accepted Answer

A policy engine that continuously evaluates trust based on user identity, device health, and context.. A policy engine is essential in zero trust architecture (ZTA) because it continuously evaluates trust based on user identity, device health, and context, dynamically granting or denying access. Microsegmentation is critical as it enforces granular access controls between workloads, preventing lateral movement even after an initial breach. Encrypting all traffic, including east-west communications, ensures data confidentiality and integrity across the network, aligning with the ZTA principle of never trusting and always verifying.

Answer

A single, static firewall rule that allows all traffic from the corporate VPN IP range.

Answer

A mandatory VPN for all remote users before accessing any resource.

Answer

Implicit trust for all devices that are connected to the internal network.

Question 10

Which four of the following are essential considerations when designing a secure cloud architecture in a hybrid environment? (Choose four.)

Accepted Answer

Applying least privilege principles to IAM roles and policies. Ensuring data encryption both at rest and in transit is critical in a hybrid environment to protect sensitive data from exposure during movement between cloud and on-premises resources and while stored. This includes using TLS 1.2/1.3 for data in transit and AES-256 for data at rest, addressing compliance requirements and mitigating interception risks.

Answer

Placing all cloud resources in a single availability zone to reduce latency

Answer

Using a shared secret key for all API authentication to simplify integration

Question 11

Drag and drop the steps for the TLS 1.3 handshake process into the correct order.

Accepted Answer

Step 1: ClientHello (with key share), Step 2: ServerHello + EncryptedExtensions + Certificate + CertificateVerify + Finished, Step 3: Client Finished. TLS 1.3 reduces round trips; the client and server exchange key shares early, and the server's certificate is sent in the second flight.

Answer

Step 1: ClientHello, Step 2: Client Finished, Step 3: ServerHello + EncryptedExtensions + Certificate + CertificateVerify + Finished

Answer

Step 1: ServerHello + EncryptedExtensions + Certificate + CertificateVerify + Finished, Step 2: ClientHello, Step 3: Client Finished

Answer

Step 1: ServerHello + EncryptedExtensions + Certificate + CertificateVerify + Finished, Step 2: Client Finished, Step 3: ClientHello

Question 12

A financial services firm is designing a new online banking platform. The security team wants to ensure that even if an attacker compromises the web front-end, they cannot access the database directly. The design should enforce least privilege and provide a choke point for monitoring and logging. Which of the following security architecture concepts best meets this requirement?

Accepted Answer

Implement a screened subnet (DMZ) with a reverse proxy and a firewall between the web tier and the database tier.. The correct answer is the screened subnet with a reverse proxy and firewall between tiers. This design enforces network segmentation, least privilege, and provides a central point for monitoring and logging. Other options focus on host-level protection, data-at-rest encryption, or availability, none of which prevent lateral movement from a compromised web front-end to the database.

Answer

Deploy a host-based intrusion prevention system (HIPS) on the web servers.

Answer

Use a load balancer to distribute traffic across multiple web servers.

Answer

Enable full-disk encryption on the database servers.

Question 13

A multinational corporation is implementing a secure remote access solution for its employees. The security team requires that all remote sessions be encrypted, that users authenticate with multifactor authentication (MFA), and that the solution supports granular access control based on user identity and device posture. Which of the following technologies best meets these requirements?

Accepted Answer

Software-defined perimeter (SDP) with zero trust network access (ZTNA).. The correct answer is SDP with ZTNA. It uniquely combines encryption, MFA, and granular, context-aware access control based on user identity and device posture. Other options may provide encryption and authentication but lack the dynamic, identity-centric access control that the scenario demands. SDP with ZTNA is designed for zero trust environments, making it the most suitable choice.

Answer

Remote Desktop Protocol (RDP) gateway with Network Level Authentication (NLA).

Answer

SSL VPN with split tunneling and a captive portal.

Answer

IPsec VPN with pre-shared keys and static routing.

Question 14

A hospital is deploying a new medical imaging system that stores patient data. The system must ensure that data remains confidential even if the physical storage media is stolen. Which of the following controls should be implemented?

Accepted Answer

Full-disk encryption (FDE) on the storage media.. The correct answer is full-disk encryption. It is the only control that ensures data confidentiality if the physical storage media is stolen, because the data is encrypted and inaccessible without the key. Other options address access control, network security, or user awareness, none of which protect data at rest against physical theft.

Answer

Regular security awareness training for staff.

Answer

Network segmentation using VLANs.

Answer

File-level access controls based on user roles.

Question 15

A company is implementing a defense-in-depth strategy for its internal network. The security team wants to detect and respond to malicious activities that might bypass perimeter defenses. Which two controls should be implemented to provide continuous monitoring and analysis of network traffic and endpoint activities? (Choose two.)

Accepted Answer

Intrusion detection system (IDS) sensors placed on critical network segments.. The correct answers are IDS sensors and a SIEM system. IDS sensors detect suspicious network traffic, while a SIEM aggregates and correlates logs for comprehensive analysis. Together, they provide continuous monitoring and detection of malicious activities that bypass perimeter defenses. The other options are preventive or availability controls, not detection and analysis tools.

Answer

Host-based firewall on each employee workstation.

Answer

Uninterruptible power supply (UPS) for network devices.

Answer

Data loss prevention (DLP) endpoint agent.