SY0-701 Security Architecture Practice Test 2 — 15 Questions

Question 1

A small company is deploying a public web application with a front-end server, an application server, and a database. Which two design choices best reduce exposure of the backend systems? Select two.

Accepted Answer

Place the web server in a DMZ that is reachable from the internet.. Placing the web server in a DMZ (demilitarized zone) allows it to be reachable from the internet while isolating it from the internal network. This design ensures that even if the web server is compromised, an attacker cannot directly access the application server or database, as traffic must pass through a firewall with strict rules. The DMZ acts as a buffer zone, reducing the attack surface of backend systems.

Answer

Put the database on the same subnet as the web server for faster communication.

Answer

Allow every tier to communicate freely to simplify troubleshooting.

Answer

Use one flat VLAN for all three servers and rely on strong passwords.

Question 2

A finance portal lets one employee create a payment batch and approve it without review. Management wants to reduce fraud risk while keeping the workflow functional. Which two changes best achieve that goal? Select two.

Accepted Answer

Separate the create and approve functions into different roles or groups.. Separation of duties (A) prevents a single individual from both creating and approving a payment batch, which reduces fraud risk. Adding an independent approval step (B) ensures that a different person reviews and authorizes the payment before it is released, further enforcing separation of duties and preventing fraudulent transactions without eliminating the workflow. Together, these controls require collusion between two employees to commit fraud.

Answer

Give the same user broader administrative access to avoid delays.

Answer

Allow the same role to perform both actions but log the activity after the fact.

Answer

Remove authentication so the process is faster.

Question 3

A company wants guest laptops on Wi-Fi to reach the internet, but not internal file servers or printers. Which two changes best support that design? Select two.

Accepted Answer

Place guest devices in a separate VLAN or subnet from employee devices.. Placing guest devices in a separate VLAN or subnet (Option A) is a fundamental network segmentation technique that isolates guest traffic from the internal corporate network at Layer 2 and Layer 3. This ensures that guest laptops cannot directly communicate with internal file servers or printers unless explicitly routed, and it allows the administrator to apply distinct security policies to the guest subnet. Adding ACL or firewall rules (Option B) is also necessary to explicitly block guest traffic from reaching internal private networks, enforcing the separation at the network layer. Together, these two changes ensure guests can reach the internet while being prevented from accessing internal resources.

Answer

Put guests on the same VLAN as employees and rely on stronger Wi-Fi passwords.

Answer

Disable SSID broadcast so guests cannot discover the network name.

Answer

Allow guest devices to use the same DHCP scope as internal endpoints.

Question 4

A company is redesigning a customer portal. Internet users must reach only the web tier, the web tier must talk to the application tier, and the application tier must talk to the database tier. The security team also wants to reduce lateral movement if one server is compromised. Which three changes best meet these goals? Select three.

Accepted Answer

Place the web tier in a DMZ and publish only the reverse proxy or load balancer to the internet.. Placing the web tier in a DMZ and publishing only the reverse proxy or load balancer to the internet ensures that external users can only reach the web tier, not the application or database tiers. This aligns with the requirement to restrict internet access to the web tier only, while the reverse proxy or load balancer can inspect and forward traffic, reducing the attack surface. Placing the database tier in a separate internal subnet and allowing traffic only from the application tier restricts database access to the application tier, preventing direct exposure and limiting lateral movement. Using host-based or microsegmentation rules to restrict east-west traffic between tiers further reduces lateral movement by enforcing least privilege at the workload level, so even if one server is compromised, the attacker cannot easily move to other tiers.

Answer

Put the web, application, and database servers in the same flat VLAN so routing is simpler.

Answer

Give the database tier direct internet access for vendor patching and cloud backups.

Question 5

Employees use one corporate login to sign in to email, the ticketing portal, and the HR application. After signing in once, the other apps accept the same identity without separate passwords. What capability is this?

Accepted Answer

Single sign-on (SSO). Single sign-on (SSO) allows a user to authenticate once and gain access to multiple applications without re-entering credentials. In this scenario, the corporate login provides a token (e.g., Kerberos ticket or SAML assertion) that is accepted by the email, ticketing portal, and HR application, eliminating the need for separate passwords. This is the core capability of SSO.

Answer

Federation

Answer

Multi-factor authentication (MFA)

Answer

Session timeout

Question 6

A Windows file server was rebuilt from a gold image, but later troubleshooting re-enabled Remote Desktop, SMBv1, and the Print Spooler. The security team wants to harden the host and catch the same configuration changes early in the future. Which three actions are the best fit? Select three.

Accepted Answer

Disable unnecessary services and remove legacy protocols that are not required.. A is correct: disabling unneeded services and removing legacy protocols like SMBv1 reduces attack surface; SMBv1 is linked to EternalBlue and the Print Spooler to PrintNightmare. B is correct: configuration management enforces the approved baseline and drift alerts detect unauthorized changes, addressing early detection. C is correct: limiting admin access to a dedicated subnet or jump host reduces the chance of unauthorized reconfiguration. D and E are incorrect because open management ports increase risk and disabling logging removes visibility needed to catch issues.

Answer

Leave all management ports open so technicians can troubleshoot from anywhere.

Answer

Turn off logging to reduce the chance that attackers can see the server.

Question 7

After a server rebuild, a Linux database host still has several unnecessary services enabled, including a graphical desktop, Telnet, and a printer service. The operations team wants a secure baseline that prevents the same drift from happening again after future maintenance. Which two actions best address the issue? Select two.

Accepted Answer

Remove the unused packages and disable the unnecessary services and ports.. Removing unused packages and disabling unnecessary services directly reduces the attack surface by eliminating potential entry points like Telnet (which transmits credentials in cleartext) and unused printer services. This aligns with the principle of least functionality, ensuring only required services run on the Linux database host. However, a one-time cleanup is not enough to prevent future drift. Documenting the approved build and enforcing it with configuration management or drift detection ensures that the secure baseline is maintained after future maintenance, so the host does not regress to having unnecessary services enabled again.

Answer

Allow administrators to enable any service they need without approval during maintenance windows.

Answer

Keep the default installation profile so vendor updates are easier to apply.

Answer

Open the firewall broadly and rely only on strong passwords.

Question 8

A system administrator is creating a secure baseline for a new Linux application server. Which two actions are appropriate hardening steps? Select two.

Accepted Answer

Disable services that the server does not need to perform its job.. Disabling unnecessary services and closing unused ports reduce the attack surface by removing potential entry points for exploitation. In a Linux server baseline, services like Telnet, FTP, or unused web servers should be disabled using systemctl or by removing the associated packages, and unused listening ports should be closed via firewall rules or service configuration. This aligns with the principle of least functionality, ensuring only required processes run.

Answer

Install extra administrative tools on the server for convenience.

Answer

Enable passwordless remote shell access for faster troubleshooting.

Answer

Leave sample accounts and default demo content in place for testing.

Question 9

A security team wants to verify that a server has not drifted from its approved hardened configuration after several months of changes. Which two actions help most? Select two.

Accepted Answer

Compare the current configuration against the approved baseline.. Comparing the current configuration against the approved baseline (Option A) directly identifies deviations from the hardened state. Option B, running a configuration compliance or hardening scan, also verifies drift by automatically checking the system against known security benchmarks (e.g., CIS, DISA STIGs) or a defined policy baseline. Both actions compare the live server state to a known-good hardened configuration, making them the most effective for detecting drift. Restarting the server (C), increasing storage (D), or changing wallpaper (E) do not validate configuration drift.

Answer

Restart the server and wait for users to report problems.

Answer

Increase the storage capacity on the server.

Answer

Change the desktop wallpaper to remind users of the policy.

Question 10

A contractor signs in to a project portal that integrates several SaaS apps. Access should be granted only while the user is on a managed device, assigned to the project, and using a fresh second factor. The business also wants the contractor to avoid separate logins to each app. Which three controls best fit this design? Select three.

Accepted Answer

Use federation or SSO so the identity provider issues the session for all approved apps.. Federation or SSO (A) allows the identity provider to issue a single session token (e.g., SAML assertion or OIDC ID token) accepted by all integrated SaaS apps, eliminating separate logins while maintaining centralized session control. ABAC or conditional access rules (B) are essential for enforcing the specific conditions: the user must be on a managed device and assigned to the project, and these checks can be applied to each access request. MFA with step-up authentication (C) satisfies the requirement for a fresh second factor and adds stronger verification before the contractor reaches sensitive functions. The other options are incorrect: a shared account (D) undermines audit trails and cannot enforce per-user MFA/device compliance, and long-lived refresh tokens (E) contradict the need for fresh second factors and continuous device/project validation.

Answer

Create a shared project account so access can be revoked by changing one password.

Answer

Issue long-lived refresh tokens that never expire unless the user reports a problem.

Question 11

A customer portal must stay online if one application server fails. Which two design choices improve availability? Select two.

Accepted Answer

Use load balancing across multiple application servers.. Load balancing (A) distributes incoming traffic across multiple application servers; if one fails, the load balancer redirects traffic to the remaining healthy servers, eliminating a single point of failure. A redundant standby server (B) also improves availability by providing a failover target: if the primary server fails, the standby can take over, minimizing downtime. Both designs introduce redundancy, which is essential for high availability.

Answer

Store the application logs on a larger disk.

Answer

Increase the password length requirement for portal users.

Answer

Place all traffic on a single high-performance server.

Question 12

An architect reviews a design where an internet-facing reverse proxy in a DMZ forwards HTTPS to a web application tier, and the web tier queries a database on a protected internal subnet. The current firewall plan allows the DMZ subnet to reach the database subnet on any TCP port, and the admins want to manage the proxy without exposing it to the user VLAN. Which two changes best improve the design? Select two.

Accepted Answer

Place the public reverse proxy in a DMZ separated from the internal network by a firewall.. Placing the public reverse proxy in a DMZ separated from the internal network by a firewall enforces a layered security model. The DMZ acts as a buffer zone, ensuring that even if the proxy is compromised, the attacker cannot directly access the internal web or database tiers without traversing another firewall. Additionally, restricting DMZ-to-database access to only the required application port and source host implements least-privilege access, reducing the attack surface by preventing lateral movement to other database services or from compromised devices. Together, these changes improve segmentation and minimize exposure of internal assets.

Answer

Collapse the DMZ and internal database into the same VLAN so firewall rules are simpler.

Answer

Allow the database subnet to accept inbound connections from the internet for easier scaling.

Answer

Disable stateful inspection on the firewall so return traffic is automatically trusted.

Question 13

An office is replacing WPA2-PSK. The new design must ensure only company-managed laptops can join the wireless network, and any device that falls out of compliance must be blocked or quarantined until remediated. Which two controls best meet the requirement? Select two.

Accepted Answer

Deploy 802.1X with EAP-TLS so devices prove possession of a unique certificate.. 802.1X with EAP-TLS is correct because it requires each device to present a unique client certificate issued by the company's PKI, ensuring only managed laptops can authenticate. NAC posture checks are correct because they evaluate devices for compliance (e.g., antivirus, patches) and automatically move noncompliant devices to a remediation VLAN, effectively blocking or quarantining them until fixed. Together, these controls enforce both identity and compliance.

Answer

Use a single WPA3-Personal passphrase printed in the lobby for all managed devices.

Answer

Rely on MAC address allow lists because they cannot be forged easily.

Answer

Hide the SSID and disable client isolation to reduce discovery by attackers.

Question 14

A platform team runs production, staging, and developer containers on the same Kubernetes cluster. After a staging compromise, the team wants to reduce the chance of access to production secrets or lateral movement to other namespaces. Which two architecture changes are most effective? Select two.

Accepted Answer

Move production workloads into a separate cluster or dedicated node pool with stricter tenancy boundaries.. Moving production workloads to a separate cluster or dedicated node pool enforces stronger tenancy boundaries, preventing a compromise in staging from directly accessing production secrets or pods. Kubernetes namespaces alone do not provide strong isolation, as a single cluster shares the same control plane and node resources, making lateral movement possible. Additionally, applying network policies or microsegmentation restricts network traffic between namespaces, so even if an attacker compromises a staging pod, they cannot freely communicate with production services. Together, these changes reduce the attack surface by both isolating compute resources and limiting network paths.

Answer

Run all namespaces on the same privileged worker nodes so scaling is easier.

Answer

Store secrets as plain environment variables because container images are already isolated.

Answer

Grant every service account cluster-admin so deployments fail less often.

Question 15

A payment application must keep running if one application server fails, and the business can tolerate no more than 5 minutes of lost transactions and 30 minutes of downtime during a site outage. Which two controls best match the availability requirements? Select two.

Accepted Answer

Deploy at least two active application nodes behind a load balancer so one server failure does not interrupt service.. Deploying at least two active application nodes behind a load balancer ensures that if one server fails, traffic is automatically redirected to the remaining healthy node(s), achieving zero downtime for the application itself. This directly meets the requirement that the payment application must keep running if one application server fails. For the 5-minute RPO and 30-minute RTO during a site outage, near-real-time or synchronous database replication to a standby preserves recent transactions and allows fast failover, meeting the recovery objectives. Nightly backups or weekly snapshots cannot meet a 5-minute RPO because they introduce up to a day or week of lost data.

Answer

Use a cold site that is powered off until a disaster is declared.

Answer

Take nightly backups to meet the 5-minute recovery point objective.

Answer

Rely on weekly VM snapshots because they are faster than replication.