SY0-701 Security Architecture Practice Test 3 — 15 Questions

Question 1

A company is redesigning a three-tier customer portal. Internet users must reach only the web tier, the application tier must never be directly reachable from the internet, database traffic must flow only from the app tier, and administrators need a protected path to manage servers. Which two design choices best meet these requirements? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place the public web tier in a DMZ behind a reverse proxy or WAF so the internet never reaches application or database hosts directly.. Placing the public web tier in a DMZ behind a reverse proxy or WAF ensures that internet traffic is terminated at the proxy layer, which inspects and filters requests before forwarding them to the web servers. This architecture prevents direct internet access to the application or database tiers, enforcing the required isolation. The reverse proxy or WAF can also provide SSL/TLS termination, load balancing, and application-layer attack mitigation, aligning with the principle of defense in depth. Using a bastion host on a dedicated management network provides a secure, controlled entry point for administrative access. The bastion host is the only system allowed to initiate SSH/RDP connections to the internal servers, and its access can be tightly audited and restricted, ensuring administrators have a protected path to manage servers without exposing management interfaces to the broader network. Together, these two choices provide robust segmentation and secure admin access, while the other options fail to meet the isolation and protection requirements.

Answer

Put all three tiers on the same VLAN and depend on host-based firewalls to separate them.

Answer

Allow administrators to SSH or RDP from the standard employee VLAN for faster troubleshooting.

Answer

Expose the database listener to the internet and require strong passwords for application connections.

Question 2

A company distributes update packages through a web portal. Users must verify the portal's identity over the network, and the downloaded packages must be trusted even if the web server is later compromised. Which two controls best satisfy these goals? Select two.

Accepted Answer

Use HTTPS with a certificate from a trusted certificate authority so users can validate the portal.. HTTPS with a certificate from a trusted certificate authority (CA) allows the client to validate the web portal's identity by verifying the certificate's chain of trust and ensuring the domain name matches. This prevents man-in-the-middle attacks and confirms the server is legitimate before any data is exchanged. Digitally signing the update packages provides a way for clients to verify both the integrity and the authenticity of each package independently of the web server. Because the digital signature is created with the publisher's private key and verified with the public key, clients can trust the package even if the web server is later compromised.

Answer

Use FTP over the internet because the credentialed login keeps the transfer secure enough.

Answer

Publish a SHA-256 hash on the same download page and trust that the server will remain honest.

Answer

Use plain HTTP and rely on file permissions to protect the updates in transit.

Question 3

A virtualization host connects to an access switch through one Ethernet link. It must carry only VLAN 30 for production VMs and VLAN 40 for management VMs. A review finds the link currently accepts every VLAN, uses VLAN 1 as the native VLAN, and a guest VLAN can accidentally be added later. Which two changes best harden the design? Select two.

Accepted Answer

Prune the trunk so it carries only VLAN 30 and VLAN 40, not every possible VLAN.. Pruning the trunk to carry only VLANs 30 and 40 reduces the attack surface by preventing unauthorized VLANs (like a guest VLAN) from being accidentally added later. This aligns with the principle of least privilege for network segmentation, ensuring only necessary traffic traverses the link. Additionally, changing the native VLAN to an unused ID prevents VLAN hopping and mis-tagging risks, as the default VLAN 1 is a known default and should not be used for native VLAN traffic.

Answer

Leave the trunk open to all VLANs so future changes require no switch updates.

Answer

Keep VLAN 1 as the native VLAN because it is the vendor default and easiest to support.

Answer

Enable dynamic trunk negotiation on the host link so the virtualization server can discover VLANs automatically.

Question 4

A manufacturing floor uses barcode scanners and a kiosk terminal that cannot support full endpoint agents or frequent manual patching. USB storage has previously introduced malware, and the devices only need to run one approved application and reach a backend system. Which two controls best reduce risk while preserving function? Select two.

Accepted Answer

Isolate the scanners and kiosk terminal on a dedicated VLAN that allows only the required backend ports.. Option A isolates the devices on a dedicated VLAN with strict ACLs, limiting lateral movement and restricting traffic to only the required backend ports, which preserves function while reducing risk. Option C enforces kiosk mode or application allowlisting, ensuring that only the approved application can run, which mitigates the risk of malicious executables (including those introduced via USB) without requiring frequent patching or full endpoint agents. Together, these controls reduce the attack surface and contain potential malware. Options B, D, and E increase risk or do not preserve function properly.

Answer

Place the devices on the user VLAN so patching and support tools can reach them easily.

Answer

Allow USB storage so updates can be installed manually whenever needed.

Answer

Use local administrator accounts with shared passwords to reduce support calls.

Question 5

A security architect is designing a multi-tier web application that must meet strict compliance requirements for data confidentiality and integrity. Which three of the following security architecture principles should be applied? (Choose three.)

Accepted Answer

Apply the principle of least privilege to service accounts and user roles.. The correct principles are least privilege, network segmentation, and defense in depth. Least privilege ensures that service accounts and user roles only have the permissions necessary to perform their functions, reducing the impact of compromised credentials. Network segmentation isolates the database tier from direct internet access and other untrusted networks, limiting lateral movement and protecting sensitive data. Defense in depth layers multiple security controls so that if one fails, others still provide protection, meeting strict confidentiality and integrity requirements.

Answer

Place the web server, application server, and database server on the same subnet for efficiency.

Answer

Grant all users the same level of access to simplify administration.

Answer

Rely solely on a single firewall at the network perimeter for protection.

Question 6

An organization is migrating its on-premises infrastructure to a hybrid cloud model. Which three of the following considerations are most important for maintaining a secure security architecture? (Choose three.)

Accepted Answer

Establishing a clear shared responsibility model for security between the organization and the cloud provider.. A secure hybrid cloud architecture requires a clear shared responsibility model so both parties know who secures what, preventing gaps. Consistent IAM across on-premises and cloud ensures uniform policies, roles, and MFA, reducing lateral movement risk. A secure VPN or dedicated connection protects data in transit between environments, ensuring confidentiality and integrity. Together these three form the foundation for hybrid cloud security.

Answer

Disabling all logging in the cloud to reduce storage costs.

Answer

Storing encryption keys for cloud data in the same cloud tenant for convenience.

Answer

Using a shared secret for all cloud API calls to simplify authentication.

Question 7

A company is designing a secure industrial control system (ICS) network that must be isolated from the corporate IT network. Which three of the following architectural controls should be implemented? (Choose three.)

Accepted Answer

Use a jump box (bastion host) with multi-factor authentication for administrative access to the ICS.. A unidirectional gateway (data diode) ensures that data can only flow from the ICS to the corporate network, preventing any external traffic from reaching the ICS. A DMZ provides a controlled buffer zone between the ICS and corporate networks, allowing necessary traffic to be inspected and filtered while keeping the ICS isolated. A jump box (bastion host) with multi-factor authentication provides a secure administrative entry point, ensuring that only authorized administrators can access the ICS, and all access is logged and monitored.

Answer

Place the ICS historian directly on the internet for remote monitoring by vendors.

Answer

Allow all ICS devices to use the same default credentials for ease of maintenance.

Answer

Connect the ICS and corporate networks directly through a standard router for low latency.

Question 8

Which four of the following are essential considerations when designing a secure cloud architecture in a hybrid environment? (Choose four.)

Accepted Answer

Applying least privilege principles to IAM roles and policies. Ensuring data encryption both at rest and in transit is critical in a hybrid environment to protect sensitive data from exposure during movement between cloud and on-premises resources and while stored. This includes using TLS 1.2/1.3 for data in transit and AES-256 for data at rest, addressing compliance requirements and mitigating interception risks.

Answer

Placing all cloud resources in a single availability zone to reduce latency

Answer

Using a shared secret key for all API authentication to simplify integration

Question 9

Drag and drop the steps to implement a new firewall rule in an iptables-based Linux firewall into the correct order.

Accepted Answer

Step 1: Add the rule, Step 2: Test the rule, Step 3: Verify the rule is in the list, Step 4: Save the configuration permanently.. The correct order is: Step 1 Add the rule, Step 2 Test the rule, Step 3 Verify the rule is in the list, Step 4 Save the configuration permanently. Testing before saving ensures the rule works as expected and does not cause connectivity issues before it is made permanent.

Answer

Step 1: Add the rule, Step 2: Verify the rule is in the list, Step 3: Save the configuration permanently, Step 4: Test the rule.

Answer

Step 1: Add the rule, Step 2: Save the configuration permanently, Step 3: Verify the rule is in the list, Step 4: Test the rule.

Answer

Step 1: Verify the rule is in the list, Step 2: Add the rule, Step 3: Save the configuration permanently, Step 4: Test the rule.

Question 10

A company is redesigning its network to host a public-facing web application that accesses a confidential database. The security team needs to minimize the risk of a direct attack against the database server while still allowing the web server to retrieve and update data. Which network architecture best achieves this objective?

Accepted Answer

Place the web server in the DMZ and the database server on the internal network. Configure the firewall to allow inbound traffic from the web server to the database server on the required port only.. It implements a tiered network architecture where the web server resides in the DMZ (a semi-trusted zone) and the database server is placed on the internal network, isolated from direct internet access. The firewall is configured with a stateful rule that permits only the web server's IP and the specific database port (e.g., TCP 3306 for MySQL or 1433 for MSSQL), preventing any direct inbound connections from the internet to the database. This minimizes the attack surface by ensuring that even if the web server is compromised, the database is not directly reachable from external hosts.

Answer

Place both the web server and the database server in the same DMZ segment and rely on host-based firewalls for protection.

Answer

Connect both servers to a single internal VLAN and use a reverse proxy to forward external traffic to the web server.

Answer

Use a site-to-site VPN to connect the web server and database server, and place both behind a single NAT gateway.

Question 11

A security architect is designing a new data center network that will host public-facing web servers and internal application servers handling confidential employee data. The architect places the web servers in a DMZ and the internal application servers on a separate internal network segment. A stateful firewall is configured to allow inbound HTTP/HTTPS traffic from the internet to the web servers only. The firewall also permits only the web servers to initiate outbound connections to the internal application servers on a specific TCP port, and all such traffic is encrypted using TLS. Which security architecture principle is this design primarily intended to enforce?

Accepted Answer

Defense in depth. The design enforces defense in depth by layering multiple security controls: a DMZ isolates public-facing web servers from internal networks, a stateful firewall restricts inbound traffic to HTTP/HTTPS only, and outbound connections from web servers to internal application servers are limited to a specific TCP port with TLS encryption. This layered approach ensures that even if one control fails (e.g., a web server is compromised), the attacker still faces additional barriers to reach sensitive internal systems.

Answer

Least privilege

Answer

Separation of duties

Answer

Zero trust

Question 12

A company's current remote access solution uses a traditional VPN that grants users full network-layer access to the internal LAN once authenticated. The security architect wants to adopt a zero trust architecture to reduce the risk of lateral movement by compromised endpoints. Which of the following implementations best aligns with zero trust principles?

Accepted Answer

Use a software-defined perimeter that authenticates each user and device before granting access only to specific applications.. A software-defined perimeter (SDP) implements zero trust by authenticating both the user and device before granting access to specific applications, not the entire network. This prevents lateral movement by ensuring that even after authentication, the endpoint can only reach the allowed application, not the full LAN. This aligns with the zero trust principle of 'never trust, always verify' and micro-segmentation.

Answer

Implement a next-generation firewall and require all remote traffic to pass through it with strict rules.

Answer

Deploy a secure web gateway and require all remote users to browse through a proxy.

Answer

Enable multi-factor authentication for VPN and implement a VPN concentrator with split tunneling.

Question 13

A security architect is designing a solution to process highly sensitive financial transactions in a shared cloud environment. The architect needs to ensure that the processor and memory used to handle transaction data are isolated from the host operating system and other virtual machines, even if the hypervisor is compromised. Which technology is specifically designed to provide this level of isolation for code and data during runtime?

Accepted Answer

Secure enclave (e.g., Intel SGX). Secure enclave technology, such as Intel SGX, provides hardware-enforced isolation by creating trusted execution environments (TEEs) within the CPU. Code and data inside an enclave are encrypted in memory and decrypted only within the processor, ensuring that even a compromised hypervisor or host OS cannot access the transaction data during runtime. This meets the requirement for processor and memory isolation in a shared cloud environment.

Answer

Trusted Platform Module (TPM)

Answer

Hardware Security Module (HSM)

Answer

UEFI Secure Boot

Question 14

A security architect is designing the network security for a web application hosted in a public cloud environment such as AWS. The application uses an Application Load Balancer (ALB) that distributes traffic to a fleet of web servers. The web servers must only accept traffic from the ALB, and all other inbound traffic must be blocked. The ALB itself needs to accept HTTP/HTTPS traffic from anywhere on the internet. Which of the following cloud security controls should the architect configure on the web servers' network interface to best meet this requirement, assuming the cloud provider offers both stateful and stateless network filtering options?

Accepted Answer

A stateful security group that allows inbound traffic from the ALB's security group only.. A stateful security group in AWS can reference another security group as a source, allowing inbound traffic only from instances associated with the ALB's security group. This ensures that web servers accept traffic exclusively from the ALB, while the ALB itself can accept HTTP/HTTPS from the internet via its own security group rules. Stateful filtering automatically allows return traffic, simplifying rule management and meeting the requirement precisely.

Answer

A stateless network ACL that allows inbound traffic from the ALB's subnet only.

Answer

A web application firewall (WAF) that inspects all traffic for SQL injection.

Answer

A host-based firewall on each web server that allows traffic from the ALB's private IP address.

Question 15

A security architect at a retail company is deploying a new e-commerce platform that processes credit card payments. The architect needs to minimize the scope of the PCI DSS assessment. The platform consists of a web server, an application server, and a database server. The cardholder data (credit card numbers) will be processed and stored only on the database server. Which of the following network architecture designs would best reduce the PCI DSS scope?

Accepted Answer

Place the database server in a separate, isolated network segment with a dedicated firewall that blocks all traffic except from the application server on the required port.. Isolating the database server in a separate network segment with a dedicated firewall that restricts traffic to only the application server on the required port creates a clear network segmentation boundary. This segmentation limits the cardholder data environment (CDE) to just the database server, thereby minimizing the scope of the PCI DSS assessment by excluding the web and application servers from the CDE.

Answer

Place all servers in the same VLAN and apply a host-based firewall on the database server.

Answer

Encrypt all data in transit using TLS and at rest using AES-256.

Answer

Implement network intrusion detection systems on all network segments.