SY0-701 Security Architecture Practice Test 4 — 15 Questions

Question 1

A security architect is redesigning the network for a payment card processing environment. The goal is to create a cardholder data environment (CDE) that is isolated from the rest of the corporate network to reduce PCI DSS scope. The CDE will contain only the payment application servers and the database storing credit card numbers. The architect must allow authorized administrators in the corporate network to perform updates and monitoring on the CDE servers. Which of the following network architecture designs provides the strongest isolation while still meeting the requirement for authorized administrative access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a dedicated firewall that connects the corporate network to an isolated CDE segment. Configure firewall rules to allow only SSH and RDP from a specific jump box in the corporate network to the CDE servers, and deny all other inbound traffic from the corporate network.. It uses a dedicated firewall to create a true network isolation boundary between the corporate network and the CDE, which is a core PCI DSS requirement for reducing scope. By allowing only SSH and RDP from a specific jump box, it enforces strict least-privilege administrative access while preventing any direct or uncontrolled traffic from the corporate network. This design ensures that the CDE is a separate, protected segment with a single controlled entry point, meeting both isolation and authorized access needs.

Answer

Place the CDE servers on a separate subnet within the same VLAN as the corporate network, and rely on host-based firewalls on each server to deny all traffic except from specific administrative IP addresses.

Answer

Place the CDE servers on a separate VLAN with a Layer 3 switch that uses ACLs to allow only ICMP traffic from the corporate network to the CDE for monitoring, and require administrators to physically connect to the CDE network via a dedicated console server.

Answer

Connect the CDE servers directly to the internet through a web application firewall (WAF), and require all management access to occur through a cloud-based VPN with two-factor authentication.

Question 2

A security architect is designing the wireless network for a new branch office. The branch will have two types of users: employees who need access to internal corporate resources, and guests who need internet-only access. The architect plans to use WPA3-Enterprise for the employee SSID and WPA3-SAE for the guest SSID. Which of the following additional configurations is MOST critical to prevent guests from accessing internal corporate resources?

Accepted Answer

Place the guest wireless network on a separate VLAN with a firewall rule blocking inbound traffic to the corporate VLAN.. The most critical configuration is to isolate the guest network from the corporate network. Placing the guest SSID on a separate VLAN and implementing a firewall rule that blocks inbound traffic from the guest VLAN to the corporate VLAN ensures that even if a guest device is compromised or malicious, it cannot initiate connections to internal corporate resources. This leverages network segmentation and access control lists (ACLs) to enforce the principle of least privilege.

Answer

Implement MAC address filtering on the guest SSID to allow only authorized guest devices.

Answer

Disable SSID broadcast for the guest network to make it less discoverable.

Answer

Require guests to accept a captive portal agreement before gaining internet access.

Question 3

A security operations center (SOC) analyst is overwhelmed by the volume of alerts. The management wants to implement a solution that can automatically respond to common threats, such as blocking an IP address or isolating a compromised endpoint, without requiring human intervention. Which of the following technologies best meets this requirement?

Accepted Answer

Security Orchestration, Automation, and Response (SOAR). SOAR is the correct choice because it is specifically designed to automate response actions to common security incidents, such as blocking an IP address via firewall APIs or isolating an endpoint through EDR integration, without requiring human intervention. This directly addresses the SOC analyst's alert fatigue by enabling playbook-driven, automated remediation.

Answer

Security Information and Event Management (SIEM)

Answer

Endpoint Detection and Response (EDR)

Answer

Cloud Access Security Broker (CASB)

Question 4

A company is implementing network segmentation to isolate the guest wireless network from the internal corporate network. Which of the following technologies is most appropriate to enforce this separation at Layer 2?

Accepted Answer

VLANs. VLANs (Virtual Local Area Networks) are the correct technology because they operate at Layer 2 (Data Link layer) of the OSI model, allowing network administrators to logically segment a physical switch into multiple isolated broadcast domains. By assigning the guest wireless network to a separate VLAN (e.g., VLAN 100) and the internal corporate network to another (e.g., VLAN 10), traffic between them is blocked at Layer 2 unless explicitly routed through a Layer 3 device with appropriate firewall rules. This directly enforces separation without requiring additional hardware, making VLANs the most appropriate and efficient choice for isolating guest traffic at Layer 2.

Answer

ACLs

Answer

DMZ

Answer

VPN

Question 5

Based on the exhibit, which change best reduces the blast radius if a user workstation is compromised?

Accepted Answer

Remove direct user access to the backup VLAN and allow only the dedicated backup path.. Removing direct user access to the backup VLAN and allowing only the dedicated backup path enforces network segmentation, which limits lateral movement. If a workstation in VLAN 10 is compromised, an attacker cannot pivot directly to the backup server in VLAN 30, reducing the blast radius. This aligns with the principle of least privilege and defense-in-depth for backup infrastructure.

Answer

Add more allow rules from VLAN 10 to VLAN 30 for SMB and RDP so restore jobs stay flexible.

Answer

Move the backup server into the user VLAN to avoid routing and ACL complexity.

Answer

Increase the DHCP lease time so backup jobs run less often during business hours.

Question 6

Based on the exhibit, which change should be made first to secure remote administration of the network device?

Accepted Answer

Disable Telnet and allow SSHv2 only for remote administration.. Telnet transmits all data, including credentials, in cleartext, making it vulnerable to interception. SSHv2 provides encrypted remote administration and is the secure replacement for Telnet. Disabling Telnet and enabling only SSHv2 is the immediate and necessary first step to secure remote device management.

Answer

Enable FTP so administrators can upload and download configuration files securely.

Answer

Open the management interface to any internet host as long as the password is complex.

Answer

Use one shared local administrator account for all network engineers.

Question 7

Administrators need to manage internal switches from home. Management traffic must be encrypted, MFA must be used, and no switch management interface should be exposed directly to the internet. Which design is best?

Accepted Answer

Use a VPN into the internal network, then administer the switches through a hardened jump host over SSH.. It uses a VPN to create an encrypted tunnel from the home user to the internal network, then requires SSH (which encrypts management traffic) through a hardened jump host. This design ensures MFA can be enforced at the VPN or jump host layer, and no switch management interface is directly exposed to the internet, satisfying all three requirements.

Answer

Open SSH directly to each switch on a public IP address and restrict access by source IP only.

Answer

Allow HTTPS management to each switch over the internet because the channel is encrypted.

Answer

Use Telnet inside the office and route home users through a split-tunnel VPN.

Question 8

Field staff use company-owned tablets that also run approved personal apps. Security needs business data isolated from personal data, the ability to wipe only corporate content, and enforcement of screen lock and encryption. Which two controls best fit? Select two.

Accepted Answer

Enroll the tablets in MDM and enforce encryption and a screen-lock PIN.. Mobile Device Management (MDM) enforces security policies like encryption and screen-lock PIN across the device, meeting the requirements for data protection. Option B is correct because a managed work profile or container (e.g., Android Work Profile or iOS Managed Open In) isolates corporate apps and data from personal apps, allowing selective wipe of corporate content without affecting personal data.

Answer

Allow rooted devices if the antivirus app is current.

Answer

Place all apps in one shared profile and use a single passcode for every user.

Answer

Disable remote wipe so personal photos are never affected.

Question 9

A supplier portal is browser-based and used by external partner companies. Each partner already has its own identity provider. The portal must trust assertions from those IdPs and avoid creating separate local passwords for each partner. Which integration is best?

Accepted Answer

Use SAML 2.0 federation with trust relationships to the partner identity providers.. SAML 2.0 federation is the correct choice because it enables the supplier portal to trust assertions from multiple external identity providers (IdPs) without creating local passwords. SAML uses XML-based tokens signed by the partner's IdP, allowing the portal to accept authentication claims via a trust relationship, which directly meets the requirement of avoiding separate local credentials for each partner.

Answer

Use LDAP directory synchronization for all partner users.

Answer

Use NTLM pass-through authentication to each partner account.

Answer

Use PAP over TLS so the portal can collect partner passwords securely.

Question 10

A team hosts a confidential document repository on an IaaS virtual machine. The provider secures the datacenter, hardware, and hypervisor. The organization wants to control who can decrypt the files and be able to revoke that access without changing providers. Which control is best?

Accepted Answer

Use customer-managed encryption keys in the cloud KMS or HSM.. Customer-managed encryption keys (CMEK) in a cloud KMS or HSM allow the organization to retain control over key material, enabling them to decrypt files and revoke access independently of the cloud provider. This meets the requirement to control decryption and revocation without changing providers, as the provider cannot access the keys. In contrast, provider-managed keys do not offer the same level of tenant-controlled revocation.

Answer

Use the provider's default managed encryption keys for the storage service.

Answer

Rely on security groups and network ACLs to protect the document contents.

Answer

Enable automated snapshots so deleted files can be restored later.

Question 11

An online retailer is redesigning its public web application so the web server can receive internet traffic, the application server can only be reached by the web tier, and the database server can only be reached by the application tier. Which placement best supports this design?

Accepted Answer

Put the web server in a public zone, the application server in a private zone, and the database server in an isolated internal zone.. It implements a classic three-tier architecture with network segmentation. The web server in a public zone (DMZ) accepts internet traffic, the application server in a private zone is isolated from direct internet access and only reachable by the web tier, and the database server in an isolated internal zone is only reachable by the application tier. This design enforces the principle of least privilege and minimizes the attack surface by using firewalls or security groups to restrict traffic between tiers.

Answer

Place all three servers on the same private subnet and control access only with strong passwords.

Answer

Put the database in the public zone so the web tier can query it directly from the internet.

Answer

Use a single reverse proxy for all three servers and disable network segmentation to simplify management.

Question 12

A customer portal runs on a single application server behind a database cluster. Leadership wants the portal to keep working if that application server fails, but the budget is tight and the team wants the simplest design that can automatically fail over. What should they add?

Accepted Answer

A second application server configured as an active-passive failover pair with health checks.. An active-passive failover pair with health checks provides automatic failover at the lowest complexity and cost. The passive server remains on standby, and health checks (e.g., ICMP, TCP port checks, or HTTP GET requests) detect application server failure, triggering automatic IP or service takeover. This meets the requirement for automatic failover without the expense and complexity of active-active or multi-region designs.

Answer

A cold backup server that is started manually after the outage is detected.

Answer

A multi-region active-active deployment with global traffic steering.

Answer

Additional RAID storage in the application server to prevent service interruption.

Question 13

A company is building a public web app with three tiers. Internet users should reach only the web tier, and the app tier should never be reachable from the internet. Which two network design choices support this goal? Select two.

Accepted Answer

Place the web server in a DMZ or public-facing zone.. Placing the web server in a DMZ (demilitarized zone) or public-facing zone allows internet traffic to reach only the web tier while isolating the internal network. This is a standard security architecture where the DMZ acts as a buffer, and firewall rules permit inbound HTTP/HTTPS (ports 80/443) only to the web servers, not to the application or database tiers.

Answer

Allow inbound traffic from the internet directly to the application servers.

Answer

Put the database on the guest Wi-Fi VLAN.

Answer

Use the same flat network for all three tiers.

Question 14

A web application needs to be internet-facing. The web tier must accept public traffic, the application tier should be reachable only from the web tier, and the database must be reachable only from the application tier. Which design best supports this?

Accepted Answer

Use a three-tier layout with a DMZ, an application zone, and a database zone separated by firewalls.. It implements a classic three-tier architecture with separate security zones (DMZ, application zone, database zone) each protected by firewalls. This ensures that only the web tier in the DMZ accepts public traffic, the application tier is isolated and reachable only from the web tier via firewall rules, and the database tier is further isolated and reachable only from the application tier. This layered defense aligns with the principle of defense in depth and minimizes the attack surface by enforcing strict east-west traffic segmentation.

Answer

Put all three tiers on one private subnet and rely on host firewalls.

Answer

Place the database in the DMZ so the web tier has lower latency.

Answer

Use NAT for the database server and allow inbound access from the internet.

Question 15

A customer portal must continue operating if one application server fails. The business wants a simple, cost-conscious design that improves availability. What is the best approach?

Accepted Answer

Add a second application server behind a load balancer.. Adding a second application server behind a load balancer creates an active-passive or active-active cluster that provides redundancy. If one server fails, the load balancer automatically redirects traffic to the healthy server, ensuring continuous operation. This design is cost-conscious because it uses commodity servers rather than expensive vertical scaling, and it directly improves availability by eliminating the single point of failure.

Answer

Schedule nightly backups to a different storage account.

Answer

Buy a larger server with more CPU and memory.

Answer

Move the portal to a different subnet without changing the servers.