SY0-701 Security Architecture Practice Test 2 — 15 Questions

Question 1

Field staff use company-owned tablets that also run approved personal apps. Security needs business data isolated from personal data, the ability to wipe only corporate content, and enforcement of screen lock and encryption. Which two controls best fit? Select two.

Accepted Answer

Enroll the tablets in MDM and enforce encryption and a screen-lock PIN.. Option A is correct because Mobile Device Management (MDM) enforces security policies like encryption and screen-lock PIN across the device, meeting the requirements for data protection. Option B is correct because a managed work profile or container (e.g., Android Work Profile or iOS Managed Open In) isolates corporate apps and data from personal apps, allowing selective wipe of corporate content without affecting personal data.

Answer

Allow rooted devices if the antivirus app is current.

Answer

Place all apps in one shared profile and use a single passcode for every user.

Answer

Disable remote wipe so personal photos are never affected.

Question 2

A manufacturing company is redesigning its plant network. PLCs must communicate with a SCADA server for telemetry, but neither the PLCs nor the SCADA server should be reachable from employee laptops or the internet. Which architecture best meets the requirement?

Accepted Answer

Create a separate OT zone behind a firewall with explicit allow rules only to the SCADA server.. Option B is correct because it creates an isolated OT (Operational Technology) zone using a firewall, which enforces segmentation between the industrial control systems (PLCs and SCADA) and the corporate IT network. By placing the SCADA server and PLCs behind a firewall with explicit allow rules only for necessary SCADA-to-PLC telemetry, the architecture ensures that employee laptops and the internet cannot reach these devices, meeting the requirement for no reachability from those sources.

Answer

Place the PLCs and office workstations on the same VLAN and rely on endpoint antivirus.

Answer

Publish the SCADA server through a public reverse proxy so vendors can reach it remotely.

Answer

Put the PLCs on the same subnet as user devices and hide them behind NAT.

Question 3

A supplier portal is browser-based and used by external partner companies. Each partner already has its own identity provider. The portal must trust assertions from those IdPs and avoid creating separate local passwords for each partner. Which integration is best?

Accepted Answer

Use SAML 2.0 federation with trust relationships to the partner identity providers.. SAML 2.0 federation is the correct choice because it enables the supplier portal to trust assertions from multiple external identity providers (IdPs) without creating local passwords. SAML uses XML-based tokens signed by the partner's IdP, allowing the portal to accept authentication claims via a trust relationship, which directly meets the requirement of avoiding separate local credentials for each partner.

Answer

Use LDAP directory synchronization for all partner users.

Answer

Use NTLM pass-through authentication to each partner account.

Answer

Use PAP over TLS so the portal can collect partner passwords securely.

Question 4

A team hosts a confidential document repository on an IaaS virtual machine. The provider secures the datacenter, hardware, and hypervisor. The organization wants to control who can decrypt the files and be able to revoke that access without changing providers. Which control is best?

Accepted Answer

Use customer-managed encryption keys in the cloud KMS or HSM.. Customer-managed encryption keys (CMEK) in a cloud KMS or HSM allow the organization to retain control over key material, enabling them to decrypt files and revoke access independently of the cloud provider. This meets the requirement to control decryption and revocation without changing providers, as the provider cannot access the keys. In contrast, provider-managed keys do not offer the same level of tenant-controlled revocation.

Answer

Use the provider's default managed encryption keys for the storage service.

Answer

Rely on security groups and network ACLs to protect the document contents.

Answer

Enable automated snapshots so deleted files can be restored later.

Question 5

An online retailer is redesigning its public web application so the web server can receive internet traffic, the application server can only be reached by the web tier, and the database server can only be reached by the application tier. Which placement best supports this design?

Accepted Answer

Put the web server in a public zone, the application server in a private zone, and the database server in an isolated internal zone.. Option B is correct because it implements a classic three-tier architecture with network segmentation. The web server in a public zone (DMZ) accepts internet traffic, the application server in a private zone is isolated from direct internet access and only reachable by the web tier, and the database server in an isolated internal zone is only reachable by the application tier. This design enforces the principle of least privilege and minimizes the attack surface by using firewalls or security groups to restrict traffic between tiers.

Answer

Place all three servers on the same private subnet and control access only with strong passwords.

Answer

Put the database in the public zone so the web tier can query it directly from the internet.

Answer

Use a single reverse proxy for all three servers and disable network segmentation to simplify management.

Question 6

A manufacturer wants partner-company users to access a procurement portal using their own company identities. The manufacturer does not want to create local accounts for each partner user, but it still needs to control what those users can do in the portal. Which approach should be used?

Accepted Answer

Use federated identity with role mapping so the portal trusts each partner’s identity provider.. Federated identity with role mapping allows the manufacturer to trust authentication performed by each partner's own identity provider (IdP) using standards like SAML 2.0 or OpenID Connect. This eliminates the need for local accounts while enabling fine-grained access control through roles or attributes passed in the assertion, ensuring partners can only perform authorized actions in the portal.

Answer

Create one shared partner account for each external company and reuse the same password.

Answer

Synchronize every partner user into the manufacturer’s directory and require a separate password change.

Answer

Store partner passwords in the portal database and use password reset emails for access control.

Question 7

A customer portal runs on a single application server behind a database cluster. Leadership wants the portal to keep working if that application server fails, but the budget is tight and the team wants the simplest design that can automatically fail over. What should they add?

Accepted Answer

A second application server configured as an active-passive failover pair with health checks.. Option A is correct because an active-passive failover pair with health checks provides automatic failover at the lowest complexity and cost. The passive server remains on standby, and health checks (e.g., ICMP, TCP port checks, or HTTP GET requests) detect application server failure, triggering automatic IP or service takeover. This meets the requirement for automatic failover without the expense and complexity of active-active or multi-region designs.

Answer

A cold backup server that is started manually after the outage is detected.

Answer

A multi-region active-active deployment with global traffic steering.

Answer

Additional RAID storage in the application server to prevent service interruption.

Question 8

A company is building a public web app with three tiers. Internet users should reach only the web tier, and the app tier should never be reachable from the internet. Which two network design choices support this goal? Select two.

Accepted Answer

Place the web server in a DMZ or public-facing zone.. Option A is correct because placing the web server in a DMZ (demilitarized zone) or public-facing zone allows internet traffic to reach only the web tier while isolating the internal network. This is a standard security architecture where the DMZ acts as a buffer, and firewall rules permit inbound HTTP/HTTPS (ports 80/443) only to the web servers, not to the application or database tiers.

Answer

Allow inbound traffic from the internet directly to the application servers.

Answer

Put the database on the guest Wi-Fi VLAN.

Answer

Use the same flat network for all three tiers.

Question 9

A web application needs to be internet-facing. The web tier must accept public traffic, the application tier should be reachable only from the web tier, and the database must be reachable only from the application tier. Which design best supports this?

Accepted Answer

Use a three-tier layout with a DMZ, an application zone, and a database zone separated by firewalls.. Option B is correct because it implements a classic three-tier architecture with separate security zones (DMZ, application zone, database zone) each protected by firewalls. This ensures that only the web tier in the DMZ accepts public traffic, the application tier is isolated and reachable only from the web tier via firewall rules, and the database tier is further isolated and reachable only from the application tier. This layered defense aligns with the principle of defense in depth and minimizes the attack surface by enforcing strict east-west traffic segmentation.

Answer

Put all three tiers on one private subnet and rely on host firewalls.

Answer

Place the database in the DMZ so the web tier has lower latency.

Answer

Use NAT for the database server and allow inbound access from the internet.

Question 10

A customer portal must continue operating if one application server fails. The business wants a simple, cost-conscious design that improves availability. What is the best approach?

Accepted Answer

Add a second application server behind a load balancer.. Adding a second application server behind a load balancer creates an active-passive or active-active cluster that provides redundancy. If one server fails, the load balancer automatically redirects traffic to the healthy server, ensuring continuous operation. This design is cost-conscious because it uses commodity servers rather than expensive vertical scaling, and it directly improves availability by eliminating the single point of failure.

Answer

Schedule nightly backups to a different storage account.

Answer

Buy a larger server with more CPU and memory.

Answer

Move the portal to a different subnet without changing the servers.

Question 11

A company uses four cloud applications and wants employees to sign in once with corporate credentials. The applications should trust the company’s identity platform, and disabling a user in the directory should remove access everywhere without separate password resets. Which architecture should the team implement?

Accepted Answer

Use federation with single sign-on through the corporate identity provider, such as SAML or OpenID Connect.. Option B is correct because federation with single sign-on (SSO) using the corporate identity provider (IdP) via SAML or OpenID Connect allows users to authenticate once with their corporate credentials. The cloud applications trust the IdP, so disabling a user in the corporate directory immediately revokes access across all applications without requiring separate password resets. This architecture decouples authentication from the applications and centralizes identity management.

Answer

Create separate local accounts in each cloud application and synchronize passwords manually.

Answer

Configure RADIUS authentication directly on each cloud application so users can reuse one password.

Answer

Store one shared administrator password for all users in a password vault.

Question 12

A web application must keep running if one application server fails. Management wants the simplest design that automatically switches traffic to a healthy server. Which two choices support that goal? Select two.

Accepted Answer

Place the application behind a load balancer with health checks.. Option A is correct because a load balancer with health checks can automatically detect a failed application server and redirect traffic to healthy servers, ensuring continuous availability. This is the simplest design that meets the requirement for automatic failover without manual intervention. Health checks typically use HTTP/HTTPS probes or TCP port checks to verify server responsiveness.

Answer

Run the application on a single server with nightly backups.

Answer

Disable health checks to avoid false failovers.

Answer

Put the database on the public internet for easier access.

Question 13

A company uses a SaaS email platform. The provider manages the servers and application code. Which two tasks remain the company's responsibility? Select two.

Accepted Answer

Configuring who can access company mailboxes and administrative roles.. Option A is correct because in a SaaS model, the customer retains administrative control over user access and role-based permissions. This includes configuring mailbox permissions, setting up multi-factor authentication, and managing administrative roles within the provider's interface. The provider handles the underlying infrastructure, but identity and access management (IAM) remains the customer's responsibility.

Answer

Applying security patches to the provider's mail servers.

Answer

Replacing failed provider storage disks.

Answer

Hardening the provider's hypervisor.

Question 14

Based on the exhibit, what is the best security change to address the exposed management access on the cloud VM?

Accepted Answer

Restrict SSH through a bastion host or VPN and remove direct internet access to the VM.. Option C is correct because exposing SSH directly to the internet on a cloud VM creates a significant attack surface, allowing brute-force and credential-stuffing attacks. A bastion host (jump box) or VPN provides a controlled, authenticated entry point, while removing direct internet access to the VM ensures management traffic is isolated and audited. This aligns with the principle of defense in depth and the AWS/cloud best practice of using a bastion host for administrative access.

Answer

Ask the provider to patch the guest operating system on the VM.

Answer

Move SSH to a public IP on the VM so administrators can reach it more easily.

Answer

Enable object storage versioning to protect the VM from unauthorized logins.

Question 15

An order-entry application must survive a single server failure and continue serving users if the primary site becomes unavailable. Management wants automatic failover, but does not want to pay for fully active production capacity in two regions. Which design is best?

Accepted Answer

Use two servers in one site behind a load balancer and maintain an asynchronously replicated warm standby site.. Option B is correct because it combines a load-balanced active-passive pair at the primary site with an asynchronously replicated warm standby at a secondary site. This design meets the requirement for automatic failover and continued service after a single server failure or primary site outage, while avoiding the cost of fully active multi-region capacity. Asynchronous replication ensures the standby site is ready to take over without requiring synchronous writes that would add latency or require identical production load.

Answer

Run one server and keep nightly backups in cloud object storage.

Answer

Deploy active-active multi-region capacity with identical production load in both regions.

Answer

Add RAID 1 and a spare power supply to the database server.