SY0-701 Security Architecture Practice Test 5 — 15 Questions

Question 1

A company uses four cloud applications and wants employees to sign in once with corporate credentials. The applications should trust the company’s identity platform, and disabling a user in the directory should remove access everywhere without separate password resets. Which architecture should the team implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use federation with single sign-on through the corporate identity provider, such as SAML or OpenID Connect.. Federation with single sign-on (SSO) using the corporate identity provider (IdP) via SAML or OpenID Connect allows users to authenticate once with their corporate credentials. The cloud applications trust the IdP, so disabling a user in the corporate directory immediately revokes access across all applications without requiring separate password resets. This architecture decouples authentication from the applications and centralizes identity management.

Answer

Create separate local accounts in each cloud application and synchronize passwords manually.

Answer

Configure RADIUS authentication directly on each cloud application so users can reuse one password.

Answer

Store one shared administrator password for all users in a password vault.

Question 2

A web application must keep running if one application server fails. Management wants the simplest design that automatically switches traffic to a healthy server. Which two choices support that goal? Select two.

Accepted Answer

Place the application behind a load balancer with health checks.. A load balancer with health checks can automatically detect a failed application server and redirect traffic to healthy servers, ensuring continuous availability. This is the simplest design that meets the requirement for automatic failover without manual intervention. Health checks typically use HTTP/HTTPS probes or TCP port checks to verify server responsiveness.

Answer

Run the application on a single server with nightly backups.

Answer

Disable health checks to avoid false failovers.

Answer

Put the database on the public internet for easier access.

Question 3

A company uses a SaaS email platform. The provider manages the servers and application code. Which two tasks remain the company's responsibility? Select two.

Accepted Answer

Configuring who can access company mailboxes and administrative roles.. In a SaaS model, the customer retains administrative control over user access and role-based permissions. This includes configuring mailbox permissions, setting up multi-factor authentication, and managing administrative roles within the provider's interface. The provider handles the underlying infrastructure, but identity and access management (IAM) remains the customer's responsibility.

Answer

Applying security patches to the provider's mail servers.

Answer

Replacing failed provider storage disks.

Answer

Hardening the provider's hypervisor.

Question 4

Based on the exhibit, what is the best security change to address the exposed management access on the cloud VM?

Accepted Answer

Restrict SSH through a bastion host or VPN and remove direct internet access to the VM.. Exposing SSH directly to the internet on a cloud VM creates a significant attack surface, allowing brute-force and credential-stuffing attacks. A bastion host (jump box) or VPN provides a controlled, authenticated entry point, while removing direct internet access to the VM ensures management traffic is isolated and audited. This aligns with the principle of defense in depth and the AWS/cloud best practice of using a bastion host for administrative access.

Answer

Ask the provider to patch the guest operating system on the VM.

Answer

Move SSH to a public IP on the VM so administrators can reach it more easily.

Answer

Enable object storage versioning to protect the VM from unauthorized logins.

Question 5

An order-entry application must survive a single server failure and continue serving users if the primary site becomes unavailable. Management wants automatic failover, but does not want to pay for fully active production capacity in two regions. Which design is best?

Accepted Answer

Use two servers in one site behind a load balancer and maintain an asynchronously replicated warm standby site.. It combines a load-balanced active-passive pair at the primary site with an asynchronously replicated warm standby at a secondary site. This design meets the requirement for automatic failover and continued service after a single server failure or primary site outage, while avoiding the cost of fully active multi-region capacity. Asynchronous replication ensures the standby site is ready to take over without requiring synchronous writes that would add latency or require identical production load.

Answer

Run one server and keep nightly backups in cloud object storage.

Answer

Deploy active-active multi-region capacity with identical production load in both regions.

Answer

Add RAID 1 and a spare power supply to the database server.

Question 6

System administrators need to manage internal switches from home. The solution must encrypt management traffic, strongly authenticate users, and avoid exposing management ports directly to the internet. What should be used?

Accepted Answer

A VPN into the internal network, then SSH or HTTPS for administration.. A VPN creates an encrypted tunnel over the internet, protecting management traffic in transit. Once connected to the internal network, SSH (for CLI) or HTTPS (for web GUI) provides strong authentication and encryption for switch administration. This approach avoids exposing management ports directly to the internet, reducing the attack surface.

Answer

Telnet over port 23 with an allow list on the firewall.

Answer

RDP directly to the switch management interface from the public IP address.

Answer

Open the management port to the internet and rely on a long password.

Question 7

An online retailer is redesigning a network for a public web app. Customers must reach only the web tier from the internet. The web tier must reach the application tier, and the application tier must reach the database tier. Which two design changes best support this zoning model? Select two.

Accepted Answer

Put the internet-facing web tier in a DMZ with tightly filtered inbound rules.. Placing the internet-facing web tier in a DMZ (demilitarized zone) with tightly filtered inbound rules ensures that external users can only reach the web servers, while the DMZ network isolates them from internal tiers. This aligns with the principle of defense in depth, where the DMZ acts as a buffer zone, and inbound rules (e.g., allowing only TCP/443 for HTTPS) minimize the attack surface. The web tier can then initiate outbound connections to the application tier through a firewall with specific allow-lists, maintaining strict segmentation.

Answer

Place all three server tiers on the same flat VLAN and rely on host firewalls.

Answer

Give the database server a public IP address so the web tier can connect faster.

Answer

Use a single NAT device for all servers and disable interserver filtering.

Question 8

Network engineers need to manage switches in a data center from home. The solution must encrypt management traffic, strongly authenticate users, and avoid exposing management ports directly to the internet. Which approach is best?

Accepted Answer

Connect through a VPN to a bastion host, then use SSH to the switches.. It combines a VPN (which encrypts all traffic and provides strong authentication) with a bastion host (a hardened jump server) to avoid exposing switch management interfaces directly to the internet. SSH then provides encrypted, authenticated access to the switches from the bastion host, meeting all three requirements: encryption, strong authentication, and no direct internet exposure.

Answer

Telnet to the switches over a router port-forward rule.

Answer

SSH directly to the switches from the internet using password-only authentication.

Answer

Use SNMPv2c with restricted source IP addresses.

Question 9

An online ticketing system must survive a single server failure and continue operating after a primary site outage. The business wants the lowest-cost design that still improves availability. Which architecture is best?

Accepted Answer

Use an active-passive design with replicated data and automatic failover to a secondary site.. An active-passive design with replicated data and automatic failover (Option B) meets the requirement of surviving a single server failure and a primary site outage while minimizing cost. Unlike active-active, it uses standby resources that only activate during failover, reducing operational expense. This architecture improves availability without the complexity and cost of multi-region active-active deployment.

Answer

Deploy active-active servers across multiple regions with load balancing.

Answer

Schedule nightly backups and restore only after the outage is confirmed.

Answer

Add RAID to the server to protect against all availability failures.

Question 10

A hospital is redesigning its wireless network. Guest devices must reach only the internet. Staff laptops need access to internal applications. Medical devices must communicate with a monitoring server but never with guest devices or the broader employee LAN. What design best meets these goals with the least operational complexity?

Accepted Answer

Create separate VLANs for guest, staff, and medical devices, then enforce traffic rules between them with firewall policies.. VLANs logically segment the network into isolated broadcast domains for guest, staff, and medical devices, while firewall policies (e.g., using ACLs or stateful inspection) enforce granular traffic rules. This design ensures medical devices can only communicate with the monitoring server, guests are restricted to internet-only access, and staff can reach internal applications, all without requiring complex physical reconfiguration.

Answer

Place all devices on one flat network and rely on endpoint antivirus for protection.

Answer

Use a single wireless SSID with client isolation enabled and NAT all traffic through one gateway.

Answer

Deploy network access control only at login time and allow all devices onto the same internal subnet afterward.

Question 11

An organization is redesigning its office network. Guest Wi-Fi must reach the internet only, employee laptops need access to internal apps, and a payment-processing system must be separated from general user traffic but still reach one database server. Which design best meets these requirements?

Accepted Answer

Create separate VLANs or subnets for guest, user, and payment zones, then filter inter-zone traffic with firewalls or ACLs.. It uses VLANs or subnets to segment guest, employee, and payment-processing traffic into separate broadcast domains, then applies firewall rules or ACLs to control inter-zone traffic. This allows guest Wi-Fi to be restricted to internet-only access, employee laptops to reach internal apps, and the payment system to communicate only with its specific database server while being isolated from general user traffic.

Answer

Place all devices on one flat network and rely on host firewalls for isolation.

Answer

Put the payment system in a DMZ and allow direct internet access for database synchronization.

Answer

Use NAT on every endpoint so internal devices cannot be individually identified on the network.

Question 12

Based on the exhibit, which architecture best meets the goal of keeping the order service running if one application server fails?

Accepted Answer

Run the application servers active-active behind the load balancer.. An active-active architecture behind a load balancer ensures that if one application server fails, the load balancer automatically redirects traffic to the remaining healthy server(s). This provides high availability and fault tolerance without manual intervention, keeping the order service running continuously.

Answer

Use one active server with a warm standby server that is started manually during outages.

Answer

Store the application binaries on RAID 1 disks to prevent service interruption.

Answer

Take nightly backups of the application servers and restore them after a failure.

Question 13

A manufacturer needs to grant a partner company access to a procurement portal. Partner users should authenticate with their own identity provider, and the manufacturer does not want to create local passwords for each partner employee. Which design best supports this?

Accepted Answer

Establish federation with SAML or OIDC and support just-in-time provisioning for partner users.. Federation with SAML or OIDC allows the partner company to use its own identity provider for authentication, eliminating the need for local passwords. Just-in-time provisioning automatically creates user accounts in the manufacturer's procurement portal upon first successful authentication, ensuring access is granted without manual account management. This design supports secure cross-organization trust without sharing credentials or maintaining duplicate user stores.

Answer

Create local accounts for every partner user and reset passwords manually when staff changes occur.

Answer

Share one VPN credential with the partner organization and let them manage access internally.

Answer

Use NTLM pass-through authentication to avoid setting up trust relationships.

Question 14

A company wants guest laptops on Wi-Fi to reach the internet but not internal printers or servers. Which two changes best support this design? Select two.

Accepted Answer

Assign guest access points to a separate VLAN with its own subnet.. Assigning guest access points to a separate VLAN with its own subnet isolates guest traffic at Layer 2, preventing direct communication with internal devices like printers and servers. This segmentation is a foundational step for enforcing access control policies without relying solely on higher-layer filtering.

Answer

Allow guests on the same VLAN as employee devices for simpler routing.

Answer

Enable WPA2-Enterprise on employee wireless only, and reuse that on guest devices.

Answer

Put printers on the guest VLAN so guests can print directly.

Question 15

An enterprise is moving from on-prem identity to a SaaS HR platform. Employees should sign in with corporate credentials, and terminated users must lose access quickly without manually creating or deleting SaaS passwords. Which solution best fits?

Accepted Answer

Implement federated SSO with the corporate identity provider and automated provisioning and deprovisioning.. Federated SSO with the corporate identity provider (IdP) allows employees to sign in using their existing corporate credentials via standards like SAML 2.0 or OIDC, eliminating the need for separate SaaS passwords. Automated provisioning and deprovisioning (e.g., via SCIM) ensures that when a user is terminated in the HR platform, their access to the SaaS application is revoked immediately without manual intervention, meeting the requirement for rapid access removal.

Answer

Create a shared HR password for all employees and change it quarterly.

Answer

Use LDAP bind accounts directly against the SaaS platform for every login.

Answer

Require each user to create a separate local SaaS account and store the credentials in a vault.