SY0-701 Security Architecture Practice Test 5 — 15 Questions

Question 1

Employees use a browser-based SaaS portal, a native expense app, and an internal API. The company wants one corporate identity, API access without separate passwords, and automatic account removal when HR disables a user. Which solution best fits?

Accepted Answer

Use OpenID Connect federation with OAuth 2.0 access tokens and SCIM provisioning.. OpenID Connect (OIDC) federation with OAuth 2.0 provides a single corporate identity (federated SSO), allows API access without separate passwords (using access tokens), and SCIM provisioning automates account removal when HR disables a user. This combination meets all three requirements: unified identity, passwordless API access, and lifecycle management.

Answer

Use LDAP binds directly against each application and manage local passwords separately.

Answer

Use shared local accounts in each application and sync passwords nightly from the directory.

Answer

Use Kerberos constrained delegation to each vendor tenant for every application.

Question 2

A company needs a public website that anyone on the internet can reach, but the application and database servers must stay off the internet. Where should the web server be placed?

Accepted Answer

In a DMZ separated from the internal application and database networks.. The web server must be placed in a DMZ (demilitarized zone) because this network segment is designed to host publicly accessible services while isolating them from internal networks. The DMZ allows inbound traffic from the internet to the web server, but the application and database servers remain on internal networks with strict firewall rules that block direct internet access, enforcing a layered security architecture.

Answer

On the internal user network with the database server.

Answer

On the same subnet as the firewall management interface.

Answer

Directly on the database subnet so performance is faster.

Question 3

A company uses a SaaS file-sharing platform for employee documents. Which action is the company's responsibility, not the provider's?

Accepted Answer

Setting user sharing permissions and access controls for company data.. In a SaaS model, the provider manages the underlying infrastructure, including application servers, storage, and hypervisors. The customer is responsible for configuring access controls and permissions for their own data within the application. Option B correctly identifies this shared responsibility boundary.

Answer

Patching the vendor's application servers.

Answer

Replacing failed disks in the provider's storage cluster.

Answer

Maintaining the cloud provider's identity center and hypervisor.

Question 4

Employees must sign in to several cloud applications with their corporate account, and terminated users should lose access without separate password resets in each app. What is the best solution?

Accepted Answer

Use federation with single sign-on from a central identity provider.. Federation with single sign-on (SSO) from a central identity provider (IdP) allows users to authenticate once using their corporate account, and the IdP issues security tokens (e.g., SAML assertions or OIDC tokens) that each cloud application trusts. When a user is terminated, the administrator disables the account in the IdP, and all applications immediately reject the user's tokens, eliminating the need for separate password resets in each app.

Answer

Create a separate local username and password in every cloud application.

Answer

Store the same shared password in a password manager for all applications.

Answer

Allow each application to authenticate users only by device MAC address.

Question 5

An access point connected to a switch suddenly lets guest Wi-Fi users reach an internal printer VLAN, but only on the new wiring closet. The AP uplink is configured as a trunk with dynamic negotiation enabled, native VLAN 1, and allowed VLANs 10, 20, and 30. Guest traffic should be VLAN 40 and must not transit to internal segments. Which change best fixes the issue?

Accepted Answer

Disable dynamic trunk negotiation, configure a static trunk, allow only VLANs 40 and 99, and move the native VLAN to an unused value.. The issue is that guest traffic (VLAN 40) is not in the allowed list, so the trunk is dropping it; however, the native VLAN 1 is being used for management and may leak traffic. By disabling dynamic trunk negotiation (DTP), configuring a static trunk, allowing only VLANs 40 and 99 (a management VLAN), and changing the native VLAN to an unused value, you ensure guest traffic is properly tagged and isolated from internal VLANs. This prevents the guest VLAN from being inadvertently trunked to internal segments and eliminates the risk of VLAN hopping via the native VLAN.

Answer

Convert the AP uplink to an access port in VLAN 40 and leave the AP to handle all traffic untagged.

Answer

Add the internal printer VLAN to the allowed list so the AP can filter client traffic itself.

Answer

Keep the trunk settings and add a layer 3 ACL between the guest and internal networks.

Question 6

A company stores customer documents in cloud object storage. The provider already offers encryption at rest and physical security. Which action most directly reduces the risk of unauthorized access to the stored files?

Accepted Answer

Configure least-privilege IAM roles, bucket policies, and object permissions for approved users only.. Option C is correct because, even with encryption at rest and physical security, unauthorized access can occur if IAM policies, bucket policies, and object permissions are overly permissive. Configuring least-privilege access ensures that only approved users can read or modify the stored files, directly reducing the attack surface. Encryption at rest protects data if storage media is compromised, but it does not prevent authorized users with excessive permissions from accessing files they shouldn't.

Answer

Assume the provider's default settings are sufficient because encryption at rest is already enabled.

Answer

Move the documents to a public bucket so users can access them without friction.

Answer

Disable encryption at rest so administrators can troubleshoot access problems more easily.

Question 7

A company wants employees to sign in once with corporate credentials and access multiple SaaS apps without creating separate passwords for each service. Which two features best support this goal? Select two.

Accepted Answer

Federation trust between the corporate identity provider and the SaaS provider.. Option A is correct because federation trust, typically implemented via standards like SAML 2.0 or OpenID Connect, establishes a trust relationship between the corporate identity provider (IdP) and each SaaS provider. This allows the SaaS app to accept authentication assertions from the corporate IdP, enabling users to sign in with their corporate credentials without needing separate passwords for each service.

Answer

Shared generic accounts for each department.

Answer

Storing the same password inside every SaaS application.

Answer

Disabling MFA so the sign-in process is faster.

Question 8

An HR system marks employees as hired, transferred, or terminated. The security team wants those changes to create, update, or disable accounts in multiple SaaS apps automatically after the user authenticates through the company identity provider. Which capability should be added?

Accepted Answer

SCIM provisioning integrated with the SSO platform.. SCIM (System for Cross-domain Identity Management) is the correct choice because it provides a standardized protocol for automating the creation, update, and deletion of user accounts across multiple SaaS applications. When integrated with an SSO platform (like SAML), SCIM handles the lifecycle events (hire, transfer, terminate) by sending RESTful API calls to each SaaS app, ensuring accounts are created, updated, or disabled without manual intervention. SAML alone only handles authentication, not account provisioning, making SCIM essential for the described automation.

Answer

SAML federation alone, with no additional account lifecycle automation.

Answer

Password synchronization between every application.

Answer

Local administrator groups on each SaaS application.

Question 9

Field staff use company-owned tablets that also run approved personal apps. Security wants corporate email and documents separated from personal data, with the ability to wipe only the work data if a device is lost. What is the best control?

Accepted Answer

Use a work profile or container managed by a mobile device management platform.. A work profile or container managed by a mobile device management (MDM) platform creates a separate, encrypted partition on the device for corporate data. This allows the organization to enforce policies and perform a selective wipe of only the work container without affecting personal apps or data, meeting the requirement for separation and targeted remote wipe.

Answer

Disable all personal apps by removing internet access from the tablet.

Answer

Install only a screen lock and require a longer PIN for the tablet.

Answer

Use a USB cable lock so the tablet cannot be physically moved.

Question 10

Administrators must manage network switches from home. Requirements: encrypted management traffic, MFA for users, no management ports exposed to the Internet, and centralized logging of admin sessions. Which solution best meets the requirements?

Accepted Answer

Use a VPN with MFA that terminates on a hardened jump host, then reach switches over SSH or HTTPS.. Option B is correct because it satisfies all requirements: a VPN with MFA encrypts management traffic, the hardened jump host provides a secure intermediary that keeps switch management ports off the Internet, and centralized logging can be implemented on the jump host to record all admin sessions. This architecture aligns with the principle of defense-in-depth by combining encrypted tunnels, strong authentication, and network segmentation.

Answer

Open SSH directly on each switch and allow access from the entire Internet.

Answer

Use port forwarding through the firewall to RDP on each switch.

Answer

Build an IPSec tunnel only between office routers and share a common admin password on the switches.

Question 11

A team stores sensitive archives on cloud block storage. The provider already encrypts disks at rest, but the company wants copies of the disks to remain unreadable even if a cloud administrator can snapshot and mount the volume. Which control is best?

Accepted Answer

Use client-side encryption before upload and keep the keys in an external HSM or key service.. Client-side encryption ensures data is encrypted before it ever reaches the cloud provider's storage. By keeping the encryption keys in an external HSM or key service, the cloud provider (including its administrators) never has access to the plaintext keys, so even if they snapshot and mount the volume, the data remains unreadable. This addresses the threat model where the provider's own administrators could otherwise access the data at rest.

Answer

Enable provider-managed encryption at rest only and rotate the storage passwords monthly.

Answer

Place the storage account in a private subnet and block all Internet access.

Answer

Rely on immutable snapshots and versioning to prevent unauthorized access.

Question 12

Field technicians use company-owned tablets that also run approved personal apps. Security needs corporate email and documents isolated from personal data, selective wipe of only business content if a device is lost, and compliance checks before access is allowed. What should be deployed?

Accepted Answer

Mobile device management with a work profile or container and conditional access.. Mobile device management (MDM) with a work profile or container (e.g., Android Work Profile or iOS Managed Open In) provides the required isolation between corporate and personal data. Conditional access enforces compliance checks (e.g., device health attestation, OS patch level) before granting access to corporate resources. This combination also enables selective wipe of only the work container without affecting personal apps or data, meeting the lost-device requirement.

Answer

Full-disk encryption on the tablets with no additional device management.

Answer

A mobile VPN client with split tunneling enabled for user convenience.

Answer

An antivirus app with a blacklist of approved and unapproved mobile apps.

Question 13

Company-owned tablets run both business apps and approved personal apps. Which two controls best keep company data separated and support selective wipe? Select two.

Accepted Answer

Mobile device management with a work profile or container for corporate data.. Option A is correct because Mobile Device Management (MDM) with a work profile or container creates a separate, encrypted partition on the device for corporate data. This container enforces policies (e.g., app whitelisting, VPN) and isolates business apps from personal apps, ensuring that company data remains protected even if the personal side is compromised.

Answer

Allow users to install any app if they promise not to open work files.

Answer

Store corporate files in the personal photo gallery for easier backup.

Answer

Disable screen locks so users can access business apps faster.

Question 14

Based on the exhibit, which integration best lets the SaaS application trust the company's existing identity provider so users can sign in with their corporate credentials?

Accepted Answer

Establish SAML federation so the SaaS app trusts the corporate identity provider.. SAML (Security Assertion Markup Language) federation allows the SaaS application to trust the corporate identity provider (IdP) by exchanging signed XML assertions. This enables users to authenticate against their corporate credentials without the SaaS app ever storing or managing those credentials, providing single sign-on (SSO) across domains.

Answer

Enable password synchronization so the SaaS app stores the same password as the directory.

Answer

Create a shared local administrator account for all subsidiary users.

Answer

Configure MAC address filtering on company laptops to allow portal access.

Question 15

Based on the exhibit, which control should be enabled so corporate data stays separated from personal data on company-owned tablets?

Accepted Answer

Enable a work profile or container with selective wipe for corporate data.. Option C is correct because a work profile or container (e.g., Android Work Profile or iOS Managed Open In) creates a separate, encrypted partition for corporate data on the device. This allows IT to perform a selective wipe of only the corporate data without affecting the user's personal apps, photos, or settings, ensuring data separation while preserving user privacy.

Answer

Perform a full-device wipe any time a tablet is lost or reassigned.

Answer

Deploy mobile threat defense scanning on every tablet.

Answer

Disable Bluetooth and the camera on all tablets to stop data leakage.