SY0-701 Security Architecture Practice Test 6 — 15 Questions

Question 1

A manufacturer wants to give partner-company users access to a procurement portal. The partner wants to authenticate its own users, and the manufacturer does not want to create separate local passwords for them. What is the best solution?

Accepted Answer

Federate access with the partner's identity provider and map claims or attributes to portal roles.. Federation with the partner's identity provider (IdP) using standards like SAML 2.0 or OIDC allows the partner to authenticate their own users while the manufacturer's portal trusts those assertions. Claims or attributes from the IdP (e.g., group membership) are mapped to portal roles, eliminating the need for local passwords and enabling single sign-on (SSO). This is the best solution because it maintains security boundaries and offloads authentication management to the partner.

Answer

Create shared portal accounts and distribute credentials to the partner's staff.

Answer

Issue one VPN account for the partner organization and let them share it internally.

Answer

Require each partner user to create a password directly in the procurement portal.

Question 2

A network team must manage switches from home without exposing management ports to the internet. Which two controls best fit? Select two.

Accepted Answer

Require a VPN before allowing access to the management network.. Requiring a VPN before allowing access to the management network ensures that all management traffic is encrypted and authenticated over the internet, effectively creating a secure tunnel that protects switch management interfaces from direct exposure. This control aligns with the principle of defense in depth by adding a layer of network segmentation and access control, preventing unauthorized external access to the switches.

Answer

Expose the switch web interface directly on a public IP address.

Answer

Use FTP to transfer configuration files because it is simple.

Answer

Send management passwords by email to approved admins.

Question 3

A team manages virtual machines in a public cloud and wants an audit trail of who created instances, changed security groups, and modified IAM settings. What should be enabled first?

Accepted Answer

Cloud control plane or audit logging.. Cloud control plane or audit logging (e.g., AWS CloudTrail, Azure Monitor, or Google Cloud Audit Logs) captures all API calls that create instances, modify security groups, or change IAM settings. This provides the required audit trail of who performed each action, when, and from what source, which is essential for security incident response and compliance.

Answer

Host-based antivirus on each virtual machine.

Answer

A guest operating system screen saver policy.

Answer

A static public IP address for every virtual machine.

Question 4

Based on the exhibit, which network change best isolates finance workstations from general user PCs while still allowing printing and application access?

VLAN table:
- VLAN 20 Users: 10.20.20.0/24
- VLAN 30 Finance: 10.20.30.0/24
- VLAN 40 Printers: 10.20.40.0/24
- VLAN 50 Accounting App: 10.20.50.0/24

Current SVI routing policy:
permit ip any any

Management goal:
Finance devices must not initiate traffic to User VLAN 20, but they must be able to print and access the accounting application.

Accepted Answer

Add inter-VLAN ACLs that deny Finance VLAN access to User VLAN 20 while permitting Finance VLAN traffic to VLAN 40 and VLAN 50.. Option B is correct because it uses inter-VLAN ACLs to enforce the principle of least privilege: denying traffic from the Finance VLAN (10.20.30.0/24) to the User VLAN (10.20.20.0/24) while explicitly permitting traffic to the Printer VLAN (10.20.40.0/24) and the Accounting App VLAN (10.20.50.0/24). This preserves the required segmentation and still allows the necessary services (printing and application access) without altering the existing VLAN structure or routing policy.

Answer

Put finance workstations on the same VLAN as the printers to simplify access.

Answer

Remove routing between all VLANs and let users print through email attachments.

Answer

Place the accounting application in the User VLAN so finance devices no longer need segmentation.

Question 5

An organization wants employees to sign in once and then access several SaaS applications without repeated logins. Which two technologies make this possible? Select two.

Accepted Answer

Single sign-on. Single sign-on (SSO) allows a user to authenticate once and then access multiple SaaS applications without re-entering credentials. It works by establishing a trusted session (often via SAML assertions or OIDC tokens) that is presented to each application, eliminating repeated logins. This directly meets the requirement for a single authentication event granting access to several services.

Answer

Network address translation

Answer

Port forwarding

Answer

Full-disk encryption

Question 6

A regulated analytics workload is moving to a public cloud. The business wants the strongest practical tenant isolation without managing physical servers, and it also needs an audit trail for changes made to the cloud environment. Which two design choices best meet those requirements? Select two.

Accepted Answer

Place the workload in a dedicated account, project, or subscription with restricted cross-account access.. Option A is correct because placing the workload in a dedicated account, project, or subscription with restricted cross-account access provides strong logical isolation at the cloud provider's control plane. This approach meets the requirement for tenant isolation without managing physical servers, as it leverages the provider's built-in resource boundaries and IAM policies to prevent unauthorized access between tenants.

Answer

Deploy the workload in a shared public subnet to simplify routing between tenants.

Answer

Assume the cloud provider will record every guest operating system event automatically.

Answer

Disable logging to reduce storage costs because the provider already has all necessary records.

Question 7

A help desk manager is hardening a fleet of Windows laptops. The goal is to prevent booting from untrusted external media and to ensure only approved software can run on the devices. Which two controls best address those goals? Select two.

Accepted Answer

Enable Secure Boot in firmware.. Secure Boot is a UEFI firmware feature that verifies the digital signature of the bootloader against a database of trusted signatures stored in the firmware. By enabling Secure Boot, the system will refuse to boot from any external media (e.g., USB drives) that does not have a valid, trusted signature, directly preventing unauthorized boot code from executing.

Answer

Rely only on full-disk encryption to stop unauthorized boot code.

Answer

Increase the screen-lock timeout so users are interrupted less often.

Answer

Use a stronger Wi-Fi password so malware cannot start.

Question 8

A small enterprise is rebuilding its public customer portal. The web front end must be reachable from the internet, the application tier should never be directly exposed, and the database must remain private even if the web server is compromised. Which two design changes best meet those goals? Select two.

Accepted Answer

Place the web front end in a DMZ behind a firewall rule allowing only HTTPS from the internet.. Option A is correct because placing the web front end in a DMZ behind a firewall rule that permits only HTTPS (TCP/443) from the internet ensures the public-facing component is isolated from internal networks. This design prevents direct inbound access to the application or database tiers, reducing the attack surface while still allowing legitimate web traffic.

Answer

Put the database on the same subnet as the web front end so internal calls have lower latency.

Answer

Allow the database to accept connections from the internet if strong passwords are used.

Answer

Disable all inbound filtering on the DMZ so troubleshooting is simpler.

Question 9

A laptop repeatedly starts with an unapproved bootloader, and the security team wants the firmware to refuse boot code that is not signed by a trusted key. Which feature should be used?

Accepted Answer

Secure Boot.. Secure Boot is a UEFI firmware feature that verifies the digital signature of bootloaders and kernel code against a database of trusted keys before allowing execution. By configuring Secure Boot to only accept boot code signed by a trusted key, the firmware will reject any unapproved bootloader, preventing unauthorized code from running during the boot process.

Answer

BitLocker full-disk encryption.

Answer

A DHCP reservation.

Answer

A local administrator password policy.

Question 10

A small company is deploying a public web application with a front-end server, an API server, and a database. The web server must be reachable from the internet, the API must be reachable only from the web server, and the database must never be accessible from user subnets. Which design best meets the requirement?

Accepted Answer

Place the web server in a DMZ, the API server in an internal subnet, and the database in a separate restricted subnet.. Option B is correct because it implements a layered security architecture: the web server resides in a DMZ (demilitarized zone) to be publicly accessible, the API server is placed in an internal subnet with firewall rules allowing only traffic from the web server, and the database is isolated in a restricted subnet with no access from user subnets. This design enforces the principle of least privilege and prevents direct internet exposure of the API and database, which is critical for protecting sensitive data.

Answer

Place all three servers on the same internal VLAN and use host firewalls only.

Answer

Place the database in the DMZ so the web server can connect to it with fewer firewall rules.

Answer

Use a single NAT gateway for all servers and rely on public IP filtering at the edge.

Question 11

A company wants employees to use one corporate login for multiple SaaS applications, require MFA when users sign in from unmanaged devices, and centralize account lifecycle management. Which design best meets these requirements?

Accepted Answer

Implement federated single sign-on through a central identity provider with MFA and conditional access policies.. Option C is correct because federated single sign-on (SSO) through a central identity provider (IdP) like Azure AD or Okta allows employees to use one corporate login across multiple SaaS applications via protocols such as SAML 2.0 or OIDC. The IdP enforces MFA for unmanaged devices through conditional access policies (e.g., device compliance checks) and centralizes account lifecycle management by provisioning/deprovisioning users from a single directory (e.g., LDAP or SCIM).

Answer

Create separate local usernames and passwords in each SaaS application.

Answer

Use shared accounts for each department and keep one password vault for the team.

Answer

Require all users to connect through a VPN before any SaaS login and remove identity federation.

Question 12

A SaaS vendor hosts a customer relationship platform for multiple organizations. Your company wants to know which two responsibilities typically remain with the customer rather than the SaaS provider. Select two.

Accepted Answer

Assigning user roles and approving access within the tenant.. Option A is correct because in a SaaS model, the customer retains administrative control over user identities, roles, and access permissions within their own tenant. The SaaS provider manages the underlying application and infrastructure, but the customer must configure role-based access control (RBAC) to enforce least privilege and approve access requests. This aligns with the shared responsibility model where identity and access management (IAM) at the application layer falls to the customer.

Answer

Patching the provider's underlying database engine.

Answer

Maintaining the vendor's physical data center power and cooling.

Answer

Replacing the provider's hypervisors during maintenance windows.

Question 13

A team is moving a workload to infrastructure as a service (IaaS). Which two items are usually the customer's responsibility? Select two.

Accepted Answer

Patch the guest operating system running on the cloud virtual machine.. In an IaaS model, the customer is responsible for managing the guest operating system, including applying security patches and updates. This is because the cloud provider only manages the underlying physical infrastructure and hypervisor, while the customer controls the OS and applications running on the virtual machine.

Answer

Replace failed power supplies in the cloud provider's data center.

Answer

Maintain the cloud provider's hypervisor firmware.

Answer

Manage the physical firewall blades inside the provider's facility.

Question 14

A company wants employees to sign in once to several SaaS apps, while the security team also wants to require extra verification when users sign in from unmanaged devices or unusual locations. Which two architecture changes best satisfy both requirements? Select two.

Accepted Answer

Federate authentication to a central identity provider.. Option A is correct because federating authentication to a central identity provider (IdP) enables single sign-on (SSO) across multiple SaaS apps using standards like SAML 2.0 or OIDC. This allows employees to sign in once, while the IdP becomes a centralized point to enforce additional security controls.

Answer

Create separate passwords for each SaaS app so compromise is contained.

Answer

Turn off MFA because single sign-on already reduces logins.

Answer

Use shared generic accounts for contractors to simplify onboarding.

Question 15

Based on the exhibit, which logging capability should be enabled first to create an audit trail for cloud administration changes?

Exhibit:
2026-04-25 09:14:03  iam:AttachRolePolicy  user=alice
2026-04-25 09:15:10  ec2:AuthorizeSecurityGroupIngress  user=alice
2026-04-25 09:16:22  s3:PutBucketPolicy  user=alice

Requirement:
Security wants to track management-plane API calls and configuration changes across cloud resources.

Accepted Answer

Enable cloud control-plane audit logging such as CloudTrail or the provider equivalent.. Option A is correct because cloud control-plane audit logging (e.g., AWS CloudTrail, Azure Monitor, or GCP Cloud Audit Logs) captures all management-plane API calls—such as IAM role attachments, security group rule changes, and bucket policy modifications—as shown in the exhibit. This directly meets the requirement to track configuration changes across cloud resources, providing a tamper-proof audit trail for security and compliance.

Answer

Install a rootkit detector on each workload and ignore management-plane activity.

Answer

Capture only DNS traffic, because it reveals all admin changes indirectly.

Answer

Rely on manual change tickets in a spreadsheet because cloud platforms do not record useful logs.