SY0-701 Security Architecture Practice Test 2 — 15 Questions

Question 1

A company is redesigning a customer portal. Internet users must reach only the web tier, the web tier must talk to the application tier, and the application tier must talk to the database tier. The security team also wants to reduce lateral movement if one server is compromised. Which three changes best meet these goals? Select three.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place the web tier in a DMZ and publish only the reverse proxy or load balancer to the internet.. Placing the web tier in a DMZ and publishing only the reverse proxy or load balancer to the internet ensures that external users can only reach the web tier, not the application or database tiers. This aligns with the requirement to restrict internet access to the web tier only, while the reverse proxy or load balancer can inspect and forward traffic, reducing the attack surface. Placing the database tier in a separate internal subnet and allowing traffic only from the application tier restricts database access to the application tier, preventing direct exposure and limiting lateral movement. Using host-based or microsegmentation rules to restrict east-west traffic between tiers further reduces lateral movement by enforcing least privilege at the workload level, so even if one server is compromised, the attacker cannot easily move to other tiers.

Answer

Put the web, application, and database servers in the same flat VLAN so routing is simpler.

Answer

Give the database tier direct internet access for vendor patching and cloud backups.

Question 2

A Windows file server was rebuilt from a gold image, but later troubleshooting re-enabled Remote Desktop, SMBv1, and the Print Spooler. The security team wants to harden the host and catch the same configuration changes early in the future. Which three actions are the best fit? Select three.

Accepted Answer

Disable unnecessary services and remove legacy protocols that are not required.. A is correct: disabling unneeded services and removing legacy protocols like SMBv1 reduces attack surface; SMBv1 is linked to EternalBlue and the Print Spooler to PrintNightmare. B is correct: configuration management enforces the approved baseline and drift alerts detect unauthorized changes, addressing early detection. C is correct: limiting admin access to a dedicated subnet or jump host reduces the chance of unauthorized reconfiguration. D and E are incorrect because open management ports increase risk and disabling logging removes visibility needed to catch issues.

Answer

Leave all management ports open so technicians can troubleshoot from anywhere.

Answer

Turn off logging to reduce the chance that attackers can see the server.

Question 3

After a server rebuild, a Linux database host still has several unnecessary services enabled, including a graphical desktop, Telnet, and a printer service. The operations team wants a secure baseline that prevents the same drift from happening again after future maintenance. Which two actions best address the issue? Select two.

Accepted Answer

Remove the unused packages and disable the unnecessary services and ports.. Removing unused packages and disabling unnecessary services directly reduces the attack surface by eliminating potential entry points like Telnet (which transmits credentials in cleartext) and unused printer services. This aligns with the principle of least functionality, ensuring only required services run on the Linux database host. However, a one-time cleanup is not enough to prevent future drift. Documenting the approved build and enforcing it with configuration management or drift detection ensures that the secure baseline is maintained after future maintenance, so the host does not regress to having unnecessary services enabled again.

Answer

Allow administrators to enable any service they need without approval during maintenance windows.

Answer

Keep the default installation profile so vendor updates are easier to apply.

Answer

Open the firewall broadly and rely only on strong passwords.

Question 4

A system administrator is creating a secure baseline for a new Linux application server. Which two actions are appropriate hardening steps? Select two.

Accepted Answer

Disable services that the server does not need to perform its job.. Disabling unnecessary services and closing unused ports reduce the attack surface by removing potential entry points for exploitation. In a Linux server baseline, services like Telnet, FTP, or unused web servers should be disabled using systemctl or by removing the associated packages, and unused listening ports should be closed via firewall rules or service configuration. This aligns with the principle of least functionality, ensuring only required processes run.

Answer

Install extra administrative tools on the server for convenience.

Answer

Enable passwordless remote shell access for faster troubleshooting.

Answer

Leave sample accounts and default demo content in place for testing.

Question 5

A security team wants to verify that a server has not drifted from its approved hardened configuration after several months of changes. Which two actions help most? Select two.

Accepted Answer

Compare the current configuration against the approved baseline.. Comparing the current configuration against the approved baseline (Option A) directly identifies deviations from the hardened state. Option B, running a configuration compliance or hardening scan, also verifies drift by automatically checking the system against known security benchmarks (e.g., CIS, DISA STIGs) or a defined policy baseline. Both actions compare the live server state to a known-good hardened configuration, making them the most effective for detecting drift. Restarting the server (C), increasing storage (D), or changing wallpaper (E) do not validate configuration drift.

Answer

Restart the server and wait for users to report problems.

Answer

Increase the storage capacity on the server.

Answer

Change the desktop wallpaper to remind users of the policy.

Question 6

A contractor signs in to a project portal that integrates several SaaS apps. Access should be granted only while the user is on a managed device, assigned to the project, and using a fresh second factor. The business also wants the contractor to avoid separate logins to each app. Which three controls best fit this design? Select three.

Accepted Answer

Use federation or SSO so the identity provider issues the session for all approved apps.. Federation or SSO (A) allows the identity provider to issue a single session token (e.g., SAML assertion or OIDC ID token) accepted by all integrated SaaS apps, eliminating separate logins while maintaining centralized session control. ABAC or conditional access rules (B) are essential for enforcing the specific conditions: the user must be on a managed device and assigned to the project, and these checks can be applied to each access request. MFA with step-up authentication (C) satisfies the requirement for a fresh second factor and adds stronger verification before the contractor reaches sensitive functions. The other options are incorrect: a shared account (D) undermines audit trails and cannot enforce per-user MFA/device compliance, and long-lived refresh tokens (E) contradict the need for fresh second factors and continuous device/project validation.

Answer

Create a shared project account so access can be revoked by changing one password.

Answer

Issue long-lived refresh tokens that never expire unless the user reports a problem.

Question 7

A customer portal must stay online if one application server fails. Which two design choices improve availability? Select two.

Accepted Answer

Use load balancing across multiple application servers.. Load balancing (A) distributes incoming traffic across multiple application servers; if one fails, the load balancer redirects traffic to the remaining healthy servers, eliminating a single point of failure. A redundant standby server (B) also improves availability by providing a failover target: if the primary server fails, the standby can take over, minimizing downtime. Both designs introduce redundancy, which is essential for high availability.

Answer

Store the application logs on a larger disk.

Answer

Increase the password length requirement for portal users.

Answer

Place all traffic on a single high-performance server.

Question 8

An architect reviews a design where an internet-facing reverse proxy in a DMZ forwards HTTPS to a web application tier, and the web tier queries a database on a protected internal subnet. The current firewall plan allows the DMZ subnet to reach the database subnet on any TCP port, and the admins want to manage the proxy without exposing it to the user VLAN. Which two changes best improve the design? Select two.

Accepted Answer

Place the public reverse proxy in a DMZ separated from the internal network by a firewall.. Placing the public reverse proxy in a DMZ separated from the internal network by a firewall enforces a layered security model. The DMZ acts as a buffer zone, ensuring that even if the proxy is compromised, the attacker cannot directly access the internal web or database tiers without traversing another firewall. Additionally, restricting DMZ-to-database access to only the required application port and source host implements least-privilege access, reducing the attack surface by preventing lateral movement to other database services or from compromised devices. Together, these changes improve segmentation and minimize exposure of internal assets.

Answer

Collapse the DMZ and internal database into the same VLAN so firewall rules are simpler.

Answer

Allow the database subnet to accept inbound connections from the internet for easier scaling.

Answer

Disable stateful inspection on the firewall so return traffic is automatically trusted.

Question 9

An office is replacing WPA2-PSK. The new design must ensure only company-managed laptops can join the wireless network, and any device that falls out of compliance must be blocked or quarantined until remediated. Which two controls best meet the requirement? Select two.

Accepted Answer

Deploy 802.1X with EAP-TLS so devices prove possession of a unique certificate.. 802.1X with EAP-TLS is correct because it requires each device to present a unique client certificate issued by the company's PKI, ensuring only managed laptops can authenticate. NAC posture checks are correct because they evaluate devices for compliance (e.g., antivirus, patches) and automatically move noncompliant devices to a remediation VLAN, effectively blocking or quarantining them until fixed. Together, these controls enforce both identity and compliance.

Answer

Use a single WPA3-Personal passphrase printed in the lobby for all managed devices.

Answer

Rely on MAC address allow lists because they cannot be forged easily.

Answer

Hide the SSID and disable client isolation to reduce discovery by attackers.

Question 10

A platform team runs production, staging, and developer containers on the same Kubernetes cluster. After a staging compromise, the team wants to reduce the chance of access to production secrets or lateral movement to other namespaces. Which two architecture changes are most effective? Select two.

Accepted Answer

Move production workloads into a separate cluster or dedicated node pool with stricter tenancy boundaries.. Moving production workloads to a separate cluster or dedicated node pool enforces stronger tenancy boundaries, preventing a compromise in staging from directly accessing production secrets or pods. Kubernetes namespaces alone do not provide strong isolation, as a single cluster shares the same control plane and node resources, making lateral movement possible. Additionally, applying network policies or microsegmentation restricts network traffic between namespaces, so even if an attacker compromises a staging pod, they cannot freely communicate with production services. Together, these changes reduce the attack surface by both isolating compute resources and limiting network paths.

Answer

Run all namespaces on the same privileged worker nodes so scaling is easier.

Answer

Store secrets as plain environment variables because container images are already isolated.

Answer

Grant every service account cluster-admin so deployments fail less often.

Question 11

A payment application must keep running if one application server fails, and the business can tolerate no more than 5 minutes of lost transactions and 30 minutes of downtime during a site outage. Which two controls best match the availability requirements? Select two.

Accepted Answer

Deploy at least two active application nodes behind a load balancer so one server failure does not interrupt service.. Deploying at least two active application nodes behind a load balancer ensures that if one server fails, traffic is automatically redirected to the remaining healthy node(s), achieving zero downtime for the application itself. This directly meets the requirement that the payment application must keep running if one application server fails. For the 5-minute RPO and 30-minute RTO during a site outage, near-real-time or synchronous database replication to a standby preserves recent transactions and allows fast failover, meeting the recovery objectives. Nightly backups or weekly snapshots cannot meet a 5-minute RPO because they introduce up to a day or week of lost data.

Answer

Use a cold site that is powered off until a disaster is declared.

Answer

Take nightly backups to meet the 5-minute recovery point objective.

Answer

Rely on weekly VM snapshots because they are faster than replication.

Question 12

A company is redesigning a three-tier customer portal. Internet users must reach only the web tier, the application tier must never be directly reachable from the internet, database traffic must flow only from the app tier, and administrators need a protected path to manage servers. Which two design choices best meet these requirements? Select two.

Accepted Answer

Place the public web tier in a DMZ behind a reverse proxy or WAF so the internet never reaches application or database hosts directly.. Placing the public web tier in a DMZ behind a reverse proxy or WAF ensures that internet traffic is terminated at the proxy layer, which inspects and filters requests before forwarding them to the web servers. This architecture prevents direct internet access to the application or database tiers, enforcing the required isolation. The reverse proxy or WAF can also provide SSL/TLS termination, load balancing, and application-layer attack mitigation, aligning with the principle of defense in depth. Using a bastion host on a dedicated management network provides a secure, controlled entry point for administrative access. The bastion host is the only system allowed to initiate SSH/RDP connections to the internal servers, and its access can be tightly audited and restricted, ensuring administrators have a protected path to manage servers without exposing management interfaces to the broader network. Together, these two choices provide robust segmentation and secure admin access, while the other options fail to meet the isolation and protection requirements.

Answer

Put all three tiers on the same VLAN and depend on host-based firewalls to separate them.

Answer

Allow administrators to SSH or RDP from the standard employee VLAN for faster troubleshooting.

Answer

Expose the database listener to the internet and require strong passwords for application connections.

Question 13

A company distributes update packages through a web portal. Users must verify the portal's identity over the network, and the downloaded packages must be trusted even if the web server is later compromised. Which two controls best satisfy these goals? Select two.

Accepted Answer

Use HTTPS with a certificate from a trusted certificate authority so users can validate the portal.. HTTPS with a certificate from a trusted certificate authority (CA) allows the client to validate the web portal's identity by verifying the certificate's chain of trust and ensuring the domain name matches. This prevents man-in-the-middle attacks and confirms the server is legitimate before any data is exchanged. Digitally signing the update packages provides a way for clients to verify both the integrity and the authenticity of each package independently of the web server. Because the digital signature is created with the publisher's private key and verified with the public key, clients can trust the package even if the web server is later compromised.

Answer

Use FTP over the internet because the credentialed login keeps the transfer secure enough.

Answer

Publish a SHA-256 hash on the same download page and trust that the server will remain honest.

Answer

Use plain HTTP and rely on file permissions to protect the updates in transit.

Question 14

A virtualization host connects to an access switch through one Ethernet link. It must carry only VLAN 30 for production VMs and VLAN 40 for management VMs. A review finds the link currently accepts every VLAN, uses VLAN 1 as the native VLAN, and a guest VLAN can accidentally be added later. Which two changes best harden the design? Select two.

Accepted Answer

Prune the trunk so it carries only VLAN 30 and VLAN 40, not every possible VLAN.. Pruning the trunk to carry only VLANs 30 and 40 reduces the attack surface by preventing unauthorized VLANs (like a guest VLAN) from being accidentally added later. This aligns with the principle of least privilege for network segmentation, ensuring only necessary traffic traverses the link. Additionally, changing the native VLAN to an unused ID prevents VLAN hopping and mis-tagging risks, as the default VLAN 1 is a known default and should not be used for native VLAN traffic.

Answer

Leave the trunk open to all VLANs so future changes require no switch updates.

Answer

Keep VLAN 1 as the native VLAN because it is the vendor default and easiest to support.

Answer

Enable dynamic trunk negotiation on the host link so the virtualization server can discover VLANs automatically.

Question 15

A manufacturing floor uses barcode scanners and a kiosk terminal that cannot support full endpoint agents or frequent manual patching. USB storage has previously introduced malware, and the devices only need to run one approved application and reach a backend system. Which two controls best reduce risk while preserving function? Select two.

Accepted Answer

Isolate the scanners and kiosk terminal on a dedicated VLAN that allows only the required backend ports.. Option A isolates the devices on a dedicated VLAN with strict ACLs, limiting lateral movement and restricting traffic to only the required backend ports, which preserves function while reducing risk. Option C enforces kiosk mode or application allowlisting, ensuring that only the approved application can run, which mitigates the risk of malicious executables (including those introduced via USB) without requiring frequent patching or full endpoint agents. Together, these controls reduce the attack surface and contain potential malware. Options B, D, and E increase risk or do not preserve function properly.

Answer

Place the devices on the user VLAN so patching and support tools can reach them easily.

Answer

Allow USB storage so updates can be installed manually whenever needed.

Answer

Use local administrator accounts with shared passwords to reduce support calls.