SY0-701 Security Architecture Practice Test 6 — 15 Questions

Question 1

A company wants guest Wi-Fi to reach only the internet, employee laptops to reach internal apps, and payment servers to remain isolated from both. What is the best design approach?

Accepted Answer

Use separate network segments with firewall rules between guest, employee, and payment zones.. Network segmentation using separate VLANs or subnets with firewall rules enforces isolation between guest Wi-Fi, employee laptops, and payment servers. This design ensures that guest traffic can only reach the internet, employee traffic can access internal apps, and payment servers are completely isolated from both, meeting the principle of least privilege and reducing the attack surface.

Answer

Place all systems on one flat network and rely on antivirus.

Answer

Put all systems behind a single VPN so every device is treated the same.

Answer

Use a larger internet circuit so the payment servers are harder to attack.

Question 2

A customer portal must keep operating if one application server fails and also remain available if an entire site goes offline. Management is willing to pay more for automatic failover and the shortest possible interruption. Which design is best?

Accepted Answer

An active-active deployment across two sites with load balancing and replicated data.. An active-active deployment across two sites with load balancing and replicated data ensures continuous operation if one application server fails and also if an entire site goes offline. Load balancers distribute traffic to healthy servers, and synchronous data replication keeps both sites consistent, enabling automatic failover with minimal interruption. This design meets the requirement for the shortest possible interruption because failover is instantaneous and does not require manual intervention or data restoration.

Answer

A cold site that restores from nightly backups after a failure.

Answer

A single active site with one standby server in the same rack.

Answer

RAID 1 on the database server with no additional redundancy.

Question 3

A company runs a Linux virtual machine in an IaaS cloud service. The provider secures the physical datacenter and hypervisor. Which task remains the company's responsibility?

Accepted Answer

Patching the guest operating system on the virtual machine.. In an IaaS cloud model, the provider is responsible for the physical infrastructure, including the datacenter, network, storage, and hypervisor. The customer retains responsibility for securing the guest operating system, including applying patches and updates. Patching the guest OS is a shared responsibility that falls squarely on the company operating the virtual machine.

Answer

Replacing failed physical storage drives in the provider's data center.

Answer

Hardening the hypervisor that hosts the cloud tenant.

Answer

Controlling badge access to the cloud vendor's server room.

Question 4

A customer portal must keep operating if one application server fails. Management wants the simplest and lowest-cost design that still improves availability. What should the team implement?

Accepted Answer

Deploy a hot standby application server with automatic failover.. A hot standby (active/passive) application server with automatic failover provides the simplest and lowest-cost improvement to availability. It eliminates the single point of failure by having a standby server ready to take over if the primary fails, without requiring complex load balancing or synchronous replication. This design directly addresses the requirement of keeping the portal operational during a single server failure while minimizing cost and complexity.

Answer

Add more backups and schedule them every hour.

Answer

Use a second data center with synchronous replication and active-active clustering.

Answer

Restart the failed server manually after the help desk is notified.

Question 5

A SaaS vendor supports both browser access and a mobile app. The company wants employees to sign in with corporate credentials, avoid separate passwords for each app, and use token-based authentication that works well with modern APIs. Which integration should the architect choose?

Accepted Answer

OpenID Connect federation with the corporate identity provider.. OpenID Connect (OIDC) is the correct choice because it is an identity layer built on top of OAuth 2.0, designed for token-based authentication that works seamlessly with modern REST APIs and mobile apps. It allows employees to sign in with corporate credentials via the corporate identity provider (IdP), eliminates separate app passwords, and issues ID tokens (JWT) and access tokens that the SaaS vendor can validate without browser redirects.

Answer

SAML federation to the SaaS vendor using browser assertions only.

Answer

LDAP bind authentication directly against each SaaS application.

Answer

Kerberos tickets issued directly by the SaaS vendor.

Question 6

Network engineers need to administer internal switches from home. The company wants encrypted management traffic, strong user verification, and no management ports exposed directly to the internet. Which approach is best?

Accepted Answer

Require a VPN or ZTNA connection with MFA, then allow SSH or HTTPS management only through that protected tunnel.. It enforces encryption (via VPN or ZTNA tunnel), strong user verification (MFA), and network segmentation (no direct internet exposure). SSH or HTTPS management traffic is then allowed only through the protected tunnel, ensuring confidentiality, integrity, and access control. This aligns with the principle of defense in depth for remote network device administration.

Answer

Expose SSH on the internet and rely on key-based authentication alone.

Answer

Use RDP with port forwarding because it is simpler for remote support.

Answer

Allow split tunneling without MFA so engineers can reduce latency while working remotely.

Question 7

A team deploys an e-commerce application on an IaaS virtual machine. The cloud provider secures the datacenter, hardware, and hypervisor. The company wants to reduce the chance that attackers exploit outdated software on the VM itself. Which responsibility remains with the company?

Accepted Answer

Patch and harden the guest operating system and application running on the VM.. In an IaaS model, the cloud provider is responsible for the security of the cloud (datacenter, hardware, hypervisor), while the customer is responsible for security in the cloud. This includes patching and hardening the guest OS and application on the VM. The company must manage vulnerabilities in the software stack it controls to prevent exploitation of outdated components.

Answer

Replace the cloud provider’s physical security controls with on-site guards.

Answer

Install new firmware on the physical host server maintained by the provider.

Answer

Set the data center’s perimeter access badge policy.

Question 8

Based on the exhibit, which capability should be added so the SaaS app automatically creates, updates, and disables user accounts as directory changes occur?

Accepted Answer

Add SCIM provisioning between the directory and the SaaS application.. SCIM (System for Cross-domain Identity Management) is the standard protocol designed to automate user provisioning and deprovisioning between an identity provider (like a directory) and a service provider (like a SaaS app). By adding SCIM provisioning, the SaaS app can automatically create, update, and disable user accounts in response to changes in the directory, eliminating the need for manual account management.

Answer

Require MFA on the SaaS login page and leave account provisioning manual.

Answer

Change the password rotation interval to every 30 days for all users.

Answer

Store credentials in a shared spreadsheet so the help desk can disable access faster.

Question 9

An online retailer is moving its public web app, internal API, and database into separate zones. Public users must reach only the web tier. The web tier must contact the app tier, and only the app tier may query the database. Admins should manage all servers from a hardened jump host. Which design best meets these goals and minimizes lateral movement?

Accepted Answer

Create separate DMZ, application, and database zones with default-deny east-west rules and use a jump host for administration.. It implements a multi-tier network architecture with separate DMZ, application, and database zones, enforcing default-deny east-west traffic rules. This ensures that public users can only reach the web tier, the web tier can only communicate with the app tier, and only the app tier can query the database, while all administrative access is funneled through a hardened jump host, which minimizes lateral movement by restricting inter-zone traffic to only what is explicitly required.

Answer

Place all servers in one VLAN and rely on host-based firewalls to block unwanted traffic.

Answer

Put the database in the DMZ so the web tier can connect to it without extra firewall rules.

Answer

Expose the application tier to the Internet and use NAT to hide the database subnet.

Question 10

A team runs a confidential document repository on an IaaS virtual machine. The cloud provider secures the datacenter, hardware, and hypervisor. Which task remains the organization’s responsibility?

Accepted Answer

Hardening the guest operating system and controlling access to the repository application.. In an IaaS model, the cloud provider is responsible for the security of the cloud (physical datacenter, hardware, hypervisor), while the customer is responsible for security in the cloud. This includes hardening the guest OS, configuring firewalls, managing access controls, and patching the operating system and applications. Option C correctly identifies the organization's duty to secure the guest OS and the repository application.

Answer

Patching the physical hosts inside the cloud provider's datacenter.

Answer

Replacing the provider's hypervisor when a new version is released.

Answer

Managing the cloud provider's physical badge access for the server room.

Question 11

Sales staff use company laptops on public Wi-Fi and travel frequently. The company wants the disk contents unreadable if a laptop is stolen, even if the drive is removed and placed in another system. Which control is the best fit?

Accepted Answer

Enable full-disk encryption with a hardware-backed key store such as a TPM, preferably with a pre-boot PIN.. Full-disk encryption (FDE) with a hardware-backed key store like a TPM ensures that the entire disk contents are encrypted at rest. Even if the drive is removed and placed in another system, the decryption key remains bound to the original TPM, and a pre-boot PIN adds an additional authentication factor, making the data unreadable without both the TPM and the correct PIN.

Answer

Require a screen lock after five minutes of inactivity.

Answer

Encrypt only the most sensitive folders with file-level encryption.

Answer

Rely on remote wipe because the device will usually connect to the internet again.

Question 12

Company-owned tablets are used by field staff for both corporate email and approved personal apps. Security must isolate company data from personal data, allow remote wipe of only the corporate workspace, and block access if the device is rooted or encryption is disabled. Which approach best fits?

Accepted Answer

Use MDM or UEM with a managed work profile or container, compliance checks, and selective wipe.. Mobile Device Management (MDM) or Unified Endpoint Management (UEM) with a managed work profile (e.g., Android Work Profile or iOS Managed Open In) creates a separate, encrypted container for corporate data. This allows compliance checks to detect rooted devices or disabled encryption, and enables a selective wipe that removes only the corporate workspace without affecting personal apps or data.

Answer

Use a consumer anti-malware app and perform a full-device wipe if the tablet is lost.

Answer

Install a VPN app on the tablets and let users choose their own lock-screen settings.

Answer

Use application allowlisting alone and avoid enrolling the tablets in a management platform.

Question 13

A company uses a SaaS CRM platform. The provider patches the application and underlying infrastructure. Which two responsibilities remain with the company? Select two.

Accepted Answer

Set up MFA, conditional access, and user-role assignments for tenant accounts.. In a SaaS model, the customer retains responsibility for securing their tenant accounts, including configuring multi-factor authentication (MFA), conditional access policies, and role-based access control (RBAC) for users. These are identity and access management (IAM) controls that the provider cannot enforce on behalf of the customer, as they depend on the customer's specific user directory and security policies.

Answer

Patch the SaaS application's source code on the provider's servers.

Answer

Replace the provider's hypervisors with company-owned hardware.

Answer

Maintain the provider's network firewalls and datacenter cooling systems.

Question 14

Employees use a browser SaaS portal, a native mobile app, and an internal API. The company wants one corporate identity, reduced password reuse, and automated removal of access when HR terminates users. Which two solutions best meet the requirement? Select two.

Accepted Answer

Use federation so the SaaS apps trust the company's identity provider.. Federation (B) allows the SaaS portal, mobile app, and internal API to trust a single corporate identity provider (IdP) using standards like SAML 2.0 or OIDC. This gives employees one set of credentials, reduces password reuse, and enables centralized control. When HR terminates a user, the IdP can revoke access instantly, affecting all federated applications.

Answer

Create separate local usernames and passwords in each application for every employee.

Answer

Store passwords in a shared vault and let users retrieve them when needed.

Answer

Allow the mobile app to authenticate only from remembered devices, without central identity controls.

Question 15

A customer portal must keep serving users if one application server fails and also remain available if the primary site becomes unreachable. Management prefers automatic recovery over manual intervention. Which two design choices best satisfy the goal? Select two.

Accepted Answer

Deploy multiple application servers behind a load balancer across separate availability zones.. Deploying multiple application servers behind a load balancer across separate availability zones (A) provides redundancy at the application tier: if one server fails, traffic is automatically redirected to healthy servers. Replicating the database to a standby site with automatic failover (E) ensures that if the primary site becomes unreachable, the database can be promoted to active without manual intervention, meeting the requirement for automatic recovery.

Answer

Use a single high-end server with RAID 10 and a larger power supply.

Answer

Keep only nightly backups and restore manually after an outage.

Answer

Store the database on a local disk array attached to the primary server.