SY0-701 Security Architecture Practice Test 4 — 15 Questions

Question 1

A SaaS vendor supports both browser access and a mobile app. The company wants employees to sign in with corporate credentials, avoid separate passwords for each app, and use token-based authentication that works well with modern APIs. Which integration should the architect choose?

Accepted Answer

OpenID Connect federation with the corporate identity provider.. OpenID Connect (OIDC) is the correct choice because it is an identity layer built on top of OAuth 2.0, designed for token-based authentication that works seamlessly with modern REST APIs and mobile apps. It allows employees to sign in with corporate credentials via the corporate identity provider (IdP), eliminates separate app passwords, and issues ID tokens (JWT) and access tokens that the SaaS vendor can validate without browser redirects.

Answer

SAML federation to the SaaS vendor using browser assertions only.

Answer

LDAP bind authentication directly against each SaaS application.

Answer

Kerberos tickets issued directly by the SaaS vendor.

Question 2

Network engineers need to administer internal switches from home. The company wants encrypted management traffic, strong user verification, and no management ports exposed directly to the internet. Which approach is best?

Accepted Answer

Require a VPN or ZTNA connection with MFA, then allow SSH or HTTPS management only through that protected tunnel.. Option A is correct because it enforces encryption (via VPN or ZTNA tunnel), strong user verification (MFA), and network segmentation (no direct internet exposure). SSH or HTTPS management traffic is then allowed only through the protected tunnel, ensuring confidentiality, integrity, and access control. This aligns with the principle of defense in depth for remote network device administration.

Answer

Expose SSH on the internet and rely on key-based authentication alone.

Answer

Use RDP with port forwarding because it is simpler for remote support.

Answer

Allow split tunneling without MFA so engineers can reduce latency while working remotely.

Question 3

A team deploys an e-commerce application on an IaaS virtual machine. The cloud provider secures the datacenter, hardware, and hypervisor. The company wants to reduce the chance that attackers exploit outdated software on the VM itself. Which responsibility remains with the company?

Accepted Answer

Patch and harden the guest operating system and application running on the VM.. In an IaaS model, the cloud provider is responsible for the security of the cloud (datacenter, hardware, hypervisor), while the customer is responsible for security in the cloud. This includes patching and hardening the guest OS and application on the VM. The company must manage vulnerabilities in the software stack it controls to prevent exploitation of outdated components.

Answer

Replace the cloud provider’s physical security controls with on-site guards.

Answer

Install new firmware on the physical host server maintained by the provider.

Answer

Set the data center’s perimeter access badge policy.

Question 4

Based on the exhibit, which capability should be added so the SaaS app automatically creates, updates, and disables user accounts as directory changes occur?

Accepted Answer

Add SCIM provisioning between the directory and the SaaS application.. SCIM (System for Cross-domain Identity Management) is the standard protocol designed to automate user provisioning and deprovisioning between an identity provider (like a directory) and a service provider (like a SaaS app). By adding SCIM provisioning, the SaaS app can automatically create, update, and disable user accounts in response to changes in the directory, eliminating the need for manual account management.

Answer

Require MFA on the SaaS login page and leave account provisioning manual.

Answer

Change the password rotation interval to every 30 days for all users.

Answer

Store credentials in a shared spreadsheet so the help desk can disable access faster.

Question 5

An online retailer is moving its public web app, internal API, and database into separate zones. Public users must reach only the web tier. The web tier must contact the app tier, and only the app tier may query the database. Admins should manage all servers from a hardened jump host. Which design best meets these goals and minimizes lateral movement?

Accepted Answer

Create separate DMZ, application, and database zones with default-deny east-west rules and use a jump host for administration.. Option B is correct because it implements a multi-tier network architecture with separate DMZ, application, and database zones, enforcing default-deny east-west traffic rules. This ensures that public users can only reach the web tier, the web tier can only communicate with the app tier, and only the app tier can query the database, while all administrative access is funneled through a hardened jump host, which minimizes lateral movement by restricting inter-zone traffic to only what is explicitly required.

Answer

Place all servers in one VLAN and rely on host-based firewalls to block unwanted traffic.

Answer

Put the database in the DMZ so the web tier can connect to it without extra firewall rules.

Answer

Expose the application tier to the Internet and use NAT to hide the database subnet.

Question 6

A team runs a confidential document repository on an IaaS virtual machine. The cloud provider secures the datacenter, hardware, and hypervisor. Which task remains the organization’s responsibility?

Accepted Answer

Hardening the guest operating system and controlling access to the repository application.. In an IaaS model, the cloud provider is responsible for the security of the cloud (physical datacenter, hardware, hypervisor), while the customer is responsible for security in the cloud. This includes hardening the guest OS, configuring firewalls, managing access controls, and patching the operating system and applications. Option C correctly identifies the organization's duty to secure the guest OS and the repository application.

Answer

Patching the physical hosts inside the cloud provider's datacenter.

Answer

Replacing the provider's hypervisor when a new version is released.

Answer

Managing the cloud provider's physical badge access for the server room.

Question 7

Sales staff use company laptops on public Wi-Fi and travel frequently. The company wants the disk contents unreadable if a laptop is stolen, even if the drive is removed and placed in another system. Which control is the best fit?

Accepted Answer

Enable full-disk encryption with a hardware-backed key store such as a TPM, preferably with a pre-boot PIN.. Full-disk encryption (FDE) with a hardware-backed key store like a TPM ensures that the entire disk contents are encrypted at rest. Even if the drive is removed and placed in another system, the decryption key remains bound to the original TPM, and a pre-boot PIN adds an additional authentication factor, making the data unreadable without both the TPM and the correct PIN.

Answer

Require a screen lock after five minutes of inactivity.

Answer

Encrypt only the most sensitive folders with file-level encryption.

Answer

Rely on remote wipe because the device will usually connect to the internet again.

Question 8

Company-owned tablets are used by field staff for both corporate email and approved personal apps. Security must isolate company data from personal data, allow remote wipe of only the corporate workspace, and block access if the device is rooted or encryption is disabled. Which approach best fits?

Accepted Answer

Use MDM or UEM with a managed work profile or container, compliance checks, and selective wipe.. Option B is correct because Mobile Device Management (MDM) or Unified Endpoint Management (UEM) with a managed work profile (e.g., Android Work Profile or iOS Managed Open In) creates a separate, encrypted container for corporate data. This allows compliance checks to detect rooted devices or disabled encryption, and enables a selective wipe that removes only the corporate workspace without affecting personal apps or data.

Answer

Use a consumer anti-malware app and perform a full-device wipe if the tablet is lost.

Answer

Install a VPN app on the tablets and let users choose their own lock-screen settings.

Answer

Use application allowlisting alone and avoid enrolling the tablets in a management platform.

Question 9

A company uses a SaaS CRM platform. The provider patches the application and underlying infrastructure. Which two responsibilities remain with the company? Select two.

Accepted Answer

Set up MFA, conditional access, and user-role assignments for tenant accounts.. Option A is correct because in a SaaS model, the customer retains responsibility for securing their tenant accounts, including configuring multi-factor authentication (MFA), conditional access policies, and role-based access control (RBAC) for users. These are identity and access management (IAM) controls that the provider cannot enforce on behalf of the customer, as they depend on the customer's specific user directory and security policies.

Answer

Patch the SaaS application's source code on the provider's servers.

Answer

Replace the provider's hypervisors with company-owned hardware.

Answer

Maintain the provider's network firewalls and datacenter cooling systems.

Question 10

Employees use a browser SaaS portal, a native mobile app, and an internal API. The company wants one corporate identity, reduced password reuse, and automated removal of access when HR terminates users. Which two solutions best meet the requirement? Select two.

Accepted Answer

Use federation so the SaaS apps trust the company's identity provider.. Federation (B) allows the SaaS portal, mobile app, and internal API to trust a single corporate identity provider (IdP) using standards like SAML 2.0 or OIDC. This gives employees one set of credentials, reduces password reuse, and enables centralized control. When HR terminates a user, the IdP can revoke access instantly, affecting all federated applications.

Answer

Create separate local usernames and passwords in each application for every employee.

Answer

Store passwords in a shared vault and let users retrieve them when needed.

Answer

Allow the mobile app to authenticate only from remembered devices, without central identity controls.

Question 11

A customer portal must keep serving users if one application server fails and also remain available if the primary site becomes unreachable. Management prefers automatic recovery over manual intervention. Which two design choices best satisfy the goal? Select two.

Accepted Answer

Deploy multiple application servers behind a load balancer across separate availability zones.. Deploying multiple application servers behind a load balancer across separate availability zones (A) provides redundancy at the application tier: if one server fails, traffic is automatically redirected to healthy servers. Replicating the database to a standby site with automatic failover (E) ensures that if the primary site becomes unreachable, the database can be promoted to active without manual intervention, meeting the requirement for automatic recovery.

Answer

Use a single high-end server with RAID 10 and a larger power supply.

Answer

Keep only nightly backups and restore manually after an outage.

Answer

Store the database on a local disk array attached to the primary server.

Question 12

A team deploys a Linux virtual machine in IaaS and stores documents in a managed cloud object storage service. The provider secures datacenters, hardware, and the storage platform, but the organization still wants to reduce exposure. Which two tasks remain the organization's responsibility? Select two.

Accepted Answer

Patch and harden the Linux virtual machine operating system.. Option A is correct because in an IaaS model, the customer is responsible for securing the operating system of the virtual machine, including applying patches and hardening configurations. The cloud provider secures the underlying hypervisor and physical infrastructure, but the customer must manage the OS-level security controls.

Answer

Replace the provider's datacenter controls with a customer-owned firewall appliance.

Answer

Assume the provider will apply tenant-specific application permissions automatically.

Answer

Rely on the cloud provider to classify the company's documents for compliance.

Question 13

A development team deploys a Linux web server on an IaaS cloud VM. The cloud provider secures the datacenter, hardware, and hypervisor. Which control remains the organization's responsibility?

Accepted Answer

Apply OS patches and harden services running inside the virtual machine.. In an IaaS model, the provider handles the physical infrastructure, storage, networking foundation, and hypervisor layer. The customer remains responsible for what runs on the VM, including the guest operating system, services, configuration, and application patching. Hardening the server inside the VM is therefore the correct answer because it is one of the core customer responsibilities in this cloud model.

Why others are wrong: Physical badge access and hypervisor patching are provider duties in IaaS, so the customer cannot rely on those as their own control. Replacing the provider backbone is outside the scope of the customer’s operational responsibility and is not how shared responsibility works. The question asks for the organization’s remaining duty, which is securing the guest OS and its applications.

Answer

Monitor physical badge access at the provider facility.

Answer

Replace the provider's network backbone with a private carrier circuit.

Answer

Ensure the hypervisor is updated before every release cycle.

Question 14

Based on the exhibit, which change best meets the requirement that guest devices can reach the internet but must not reach any internal subnets or printer VLANs?

Accepted Answer

Move guests into a dedicated guest zone with outbound NAT and default-deny rules to internal networks.. Option B is correct because placing guest devices in a dedicated guest zone with outbound NAT allows them to access the internet while default-deny rules to internal subnets and printer VLANs enforce network segmentation. This approach uses firewall policies to explicitly block RFC 1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) from guest traffic, ensuring no Layer 3 connectivity to internal resources.

Answer

Add more allow rules for the printer VLAN so guests can print without changing routing.

Answer

Place guest and corporate devices on the same VLAN and rely on the wireless password for separation.

Answer

Allow guest traffic to reach internal DNS and DHCP servers across all RFC1918 subnets.

Question 15

Employees must sign in to several SaaS applications with corporate credentials, and terminated users should lose access quickly without manual changes in each app. Which solution best meets the requirement?

Accepted Answer

Use federation for sign-on and automated provisioning and deprovisioning through an identity lifecycle process.. Federation enables single sign-on (SSO) using standards like SAML 2.0 or OIDC, allowing users to authenticate once with corporate credentials across multiple SaaS apps. Automated provisioning and deprovisioning via SCIM (System for Cross-domain Identity Management) ensures that when an employee is terminated, their access is revoked from all connected applications instantly without manual intervention, meeting the requirement for rapid access removal.

Answer

Create separate local usernames and passwords in each SaaS application.

Answer

Require users to share one department password for each SaaS platform.

Answer

Store the same password in every application vault and sync it nightly.