SY0-701 Security Architecture Practice Test 5 — 15 Questions

Question 1

Based on the exhibit, what is the best security change to address the exposed management access on the cloud VM?

Accepted Answer

Restrict SSH through a bastion host or VPN and remove direct internet access to the VM.. Exposing SSH directly to the internet on a cloud VM creates a significant attack surface, allowing brute-force and credential-stuffing attacks. A bastion host (jump box) or VPN provides a controlled, authenticated entry point, while removing direct internet access to the VM ensures management traffic is isolated and audited. This aligns with the principle of defense in depth and the AWS/cloud best practice of using a bastion host for administrative access.

Answer

Ask the provider to patch the guest operating system on the VM.

Answer

Move SSH to a public IP on the VM so administrators can reach it more easily.

Answer

Enable object storage versioning to protect the VM from unauthorized logins.

Question 2

An order-entry application must survive a single server failure and continue serving users if the primary site becomes unavailable. Management wants automatic failover, but does not want to pay for fully active production capacity in two regions. Which design is best?

Accepted Answer

Use two servers in one site behind a load balancer and maintain an asynchronously replicated warm standby site.. It combines a load-balanced active-passive pair at the primary site with an asynchronously replicated warm standby at a secondary site. This design meets the requirement for automatic failover and continued service after a single server failure or primary site outage, while avoiding the cost of fully active multi-region capacity. Asynchronous replication ensures the standby site is ready to take over without requiring synchronous writes that would add latency or require identical production load.

Answer

Run one server and keep nightly backups in cloud object storage.

Answer

Deploy active-active multi-region capacity with identical production load in both regions.

Answer

Add RAID 1 and a spare power supply to the database server.

Question 3

System administrators need to manage internal switches from home. The solution must encrypt management traffic, strongly authenticate users, and avoid exposing management ports directly to the internet. What should be used?

Accepted Answer

A VPN into the internal network, then SSH or HTTPS for administration.. A VPN creates an encrypted tunnel over the internet, protecting management traffic in transit. Once connected to the internal network, SSH (for CLI) or HTTPS (for web GUI) provides strong authentication and encryption for switch administration. This approach avoids exposing management ports directly to the internet, reducing the attack surface.

Answer

Telnet over port 23 with an allow list on the firewall.

Answer

RDP directly to the switch management interface from the public IP address.

Answer

Open the management port to the internet and rely on a long password.

Question 4

An online retailer is redesigning a network for a public web app. Customers must reach only the web tier from the internet. The web tier must reach the application tier, and the application tier must reach the database tier. Which two design changes best support this zoning model? Select two.

Accepted Answer

Put the internet-facing web tier in a DMZ with tightly filtered inbound rules.. Placing the internet-facing web tier in a DMZ (demilitarized zone) with tightly filtered inbound rules ensures that external users can only reach the web servers, while the DMZ network isolates them from internal tiers. This aligns with the principle of defense in depth, where the DMZ acts as a buffer zone, and inbound rules (e.g., allowing only TCP/443 for HTTPS) minimize the attack surface. The web tier can then initiate outbound connections to the application tier through a firewall with specific allow-lists, maintaining strict segmentation.

Answer

Place all three server tiers on the same flat VLAN and rely on host firewalls.

Answer

Give the database server a public IP address so the web tier can connect faster.

Answer

Use a single NAT device for all servers and disable interserver filtering.

Question 5

Network engineers need to manage switches in a data center from home. The solution must encrypt management traffic, strongly authenticate users, and avoid exposing management ports directly to the internet. Which approach is best?

Accepted Answer

Connect through a VPN to a bastion host, then use SSH to the switches.. It combines a VPN (which encrypts all traffic and provides strong authentication) with a bastion host (a hardened jump server) to avoid exposing switch management interfaces directly to the internet. SSH then provides encrypted, authenticated access to the switches from the bastion host, meeting all three requirements: encryption, strong authentication, and no direct internet exposure.

Answer

Telnet to the switches over a router port-forward rule.

Answer

SSH directly to the switches from the internet using password-only authentication.

Answer

Use SNMPv2c with restricted source IP addresses.

Question 6

An online ticketing system must survive a single server failure and continue operating after a primary site outage. The business wants the lowest-cost design that still improves availability. Which architecture is best?

Accepted Answer

Use an active-passive design with replicated data and automatic failover to a secondary site.. An active-passive design with replicated data and automatic failover (Option B) meets the requirement of surviving a single server failure and a primary site outage while minimizing cost. Unlike active-active, it uses standby resources that only activate during failover, reducing operational expense. This architecture improves availability without the complexity and cost of multi-region active-active deployment.

Answer

Deploy active-active servers across multiple regions with load balancing.

Answer

Schedule nightly backups and restore only after the outage is confirmed.

Answer

Add RAID to the server to protect against all availability failures.

Question 7

A hospital is redesigning its wireless network. Guest devices must reach only the internet. Staff laptops need access to internal applications. Medical devices must communicate with a monitoring server but never with guest devices or the broader employee LAN. What design best meets these goals with the least operational complexity?

Accepted Answer

Create separate VLANs for guest, staff, and medical devices, then enforce traffic rules between them with firewall policies.. VLANs logically segment the network into isolated broadcast domains for guest, staff, and medical devices, while firewall policies (e.g., using ACLs or stateful inspection) enforce granular traffic rules. This design ensures medical devices can only communicate with the monitoring server, guests are restricted to internet-only access, and staff can reach internal applications, all without requiring complex physical reconfiguration.

Answer

Place all devices on one flat network and rely on endpoint antivirus for protection.

Answer

Use a single wireless SSID with client isolation enabled and NAT all traffic through one gateway.

Answer

Deploy network access control only at login time and allow all devices onto the same internal subnet afterward.

Question 8

An organization is redesigning its office network. Guest Wi-Fi must reach the internet only, employee laptops need access to internal apps, and a payment-processing system must be separated from general user traffic but still reach one database server. Which design best meets these requirements?

Accepted Answer

Create separate VLANs or subnets for guest, user, and payment zones, then filter inter-zone traffic with firewalls or ACLs.. It uses VLANs or subnets to segment guest, employee, and payment-processing traffic into separate broadcast domains, then applies firewall rules or ACLs to control inter-zone traffic. This allows guest Wi-Fi to be restricted to internet-only access, employee laptops to reach internal apps, and the payment system to communicate only with its specific database server while being isolated from general user traffic.

Answer

Place all devices on one flat network and rely on host firewalls for isolation.

Answer

Put the payment system in a DMZ and allow direct internet access for database synchronization.

Answer

Use NAT on every endpoint so internal devices cannot be individually identified on the network.

Question 9

Based on the exhibit, which architecture best meets the goal of keeping the order service running if one application server fails?

Accepted Answer

Run the application servers active-active behind the load balancer.. An active-active architecture behind a load balancer ensures that if one application server fails, the load balancer automatically redirects traffic to the remaining healthy server(s). This provides high availability and fault tolerance without manual intervention, keeping the order service running continuously.

Answer

Use one active server with a warm standby server that is started manually during outages.

Answer

Store the application binaries on RAID 1 disks to prevent service interruption.

Answer

Take nightly backups of the application servers and restore them after a failure.

Question 10

A manufacturer needs to grant a partner company access to a procurement portal. Partner users should authenticate with their own identity provider, and the manufacturer does not want to create local passwords for each partner employee. Which design best supports this?

Accepted Answer

Establish federation with SAML or OIDC and support just-in-time provisioning for partner users.. Federation with SAML or OIDC allows the partner company to use its own identity provider for authentication, eliminating the need for local passwords. Just-in-time provisioning automatically creates user accounts in the manufacturer's procurement portal upon first successful authentication, ensuring access is granted without manual account management. This design supports secure cross-organization trust without sharing credentials or maintaining duplicate user stores.

Answer

Create local accounts for every partner user and reset passwords manually when staff changes occur.

Answer

Share one VPN credential with the partner organization and let them manage access internally.

Answer

Use NTLM pass-through authentication to avoid setting up trust relationships.

Question 11

A company wants guest laptops on Wi-Fi to reach the internet but not internal printers or servers. Which two changes best support this design? Select two.

Accepted Answer

Assign guest access points to a separate VLAN with its own subnet.. Assigning guest access points to a separate VLAN with its own subnet isolates guest traffic at Layer 2, preventing direct communication with internal devices like printers and servers. This segmentation is a foundational step for enforcing access control policies without relying solely on higher-layer filtering.

Answer

Allow guests on the same VLAN as employee devices for simpler routing.

Answer

Enable WPA2-Enterprise on employee wireless only, and reuse that on guest devices.

Answer

Put printers on the guest VLAN so guests can print directly.

Question 12

An enterprise is moving from on-prem identity to a SaaS HR platform. Employees should sign in with corporate credentials, and terminated users must lose access quickly without manually creating or deleting SaaS passwords. Which solution best fits?

Accepted Answer

Implement federated SSO with the corporate identity provider and automated provisioning and deprovisioning.. Federated SSO with the corporate identity provider (IdP) allows employees to sign in using their existing corporate credentials via standards like SAML 2.0 or OIDC, eliminating the need for separate SaaS passwords. Automated provisioning and deprovisioning (e.g., via SCIM) ensures that when a user is terminated in the HR platform, their access to the SaaS application is revoked immediately without manual intervention, meeting the requirement for rapid access removal.

Answer

Create a shared HR password for all employees and change it quarterly.

Answer

Use LDAP bind accounts directly against the SaaS platform for every login.

Answer

Require each user to create a separate local SaaS account and store the credentials in a vault.

Question 13

A company wants guest Wi-Fi to reach only the internet, employee laptops to reach internal apps, and payment servers to remain isolated from both. What is the best design approach?

Accepted Answer

Use separate network segments with firewall rules between guest, employee, and payment zones.. Network segmentation using separate VLANs or subnets with firewall rules enforces isolation between guest Wi-Fi, employee laptops, and payment servers. This design ensures that guest traffic can only reach the internet, employee traffic can access internal apps, and payment servers are completely isolated from both, meeting the principle of least privilege and reducing the attack surface.

Answer

Place all systems on one flat network and rely on antivirus.

Answer

Put all systems behind a single VPN so every device is treated the same.

Answer

Use a larger internet circuit so the payment servers are harder to attack.

Question 14

A customer portal must keep operating if one application server fails and also remain available if an entire site goes offline. Management is willing to pay more for automatic failover and the shortest possible interruption. Which design is best?

Accepted Answer

An active-active deployment across two sites with load balancing and replicated data.. An active-active deployment across two sites with load balancing and replicated data ensures continuous operation if one application server fails and also if an entire site goes offline. Load balancers distribute traffic to healthy servers, and synchronous data replication keeps both sites consistent, enabling automatic failover with minimal interruption. This design meets the requirement for the shortest possible interruption because failover is instantaneous and does not require manual intervention or data restoration.

Answer

A cold site that restores from nightly backups after a failure.

Answer

A single active site with one standby server in the same rack.

Answer

RAID 1 on the database server with no additional redundancy.

Question 15

A company runs a Linux virtual machine in an IaaS cloud service. The provider secures the physical datacenter and hypervisor. Which task remains the company's responsibility?

Accepted Answer

Patching the guest operating system on the virtual machine.. In an IaaS cloud model, the provider is responsible for the physical infrastructure, including the datacenter, network, storage, and hypervisor. The customer retains responsibility for securing the guest operating system, including applying patches and updates. Patching the guest OS is a shared responsibility that falls squarely on the company operating the virtual machine.

Answer

Replacing failed physical storage drives in the provider's data center.

Answer

Hardening the hypervisor that hosts the cloud tenant.

Answer

Controlling badge access to the cloud vendor's server room.