SY0-701 Security Architecture Practice Test 7 — 15 Questions

Question 1

A team deploys a Linux virtual machine in IaaS and stores documents in a managed cloud object storage service. The provider secures datacenters, hardware, and the storage platform, but the organization still wants to reduce exposure. Which two tasks remain the organization's responsibility? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Patch and harden the Linux virtual machine operating system.. In an IaaS model, the customer is responsible for securing the operating system of the virtual machine, including applying patches and hardening configurations. The cloud provider secures the underlying hypervisor and physical infrastructure, but the customer must manage the OS-level security controls.

Answer

Replace the provider's datacenter controls with a customer-owned firewall appliance.

Answer

Assume the provider will apply tenant-specific application permissions automatically.

Answer

Rely on the cloud provider to classify the company's documents for compliance.

Question 2

A development team deploys a Linux web server on an IaaS cloud VM. The cloud provider secures the datacenter, hardware, and hypervisor. Which control remains the organization's responsibility?

Accepted Answer

Apply OS patches and harden services running inside the virtual machine.. In an IaaS model, the provider handles the physical infrastructure, storage, networking foundation, and hypervisor layer. The customer remains responsible for what runs on the VM, including the guest operating system, services, configuration, and application patching. Hardening the server inside the VM is therefore the correct answer because it is one of the core customer responsibilities in this cloud model.

Why others are wrong: Physical badge access and hypervisor patching are provider duties in IaaS, so the customer cannot rely on those as their own control. Replacing the provider backbone is outside the scope of the customer’s operational responsibility and is not how shared responsibility works. The question asks for the organization’s remaining duty, which is securing the guest OS and its applications.

Answer

Monitor physical badge access at the provider facility.

Answer

Replace the provider's network backbone with a private carrier circuit.

Answer

Ensure the hypervisor is updated before every release cycle.

Question 3

Based on the exhibit, which change best meets the requirement that guest devices can reach the internet but must not reach any internal subnets or printer VLANs?

Accepted Answer

Move guests into a dedicated guest zone with outbound NAT and default-deny rules to internal networks.. Placing guest devices in a dedicated guest zone with outbound NAT allows them to access the internet while default-deny rules to internal subnets and printer VLANs enforce network segmentation. This approach uses firewall policies to explicitly block RFC 1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) from guest traffic, ensuring no Layer 3 connectivity to internal resources.

Answer

Add more allow rules for the printer VLAN so guests can print without changing routing.

Answer

Place guest and corporate devices on the same VLAN and rely on the wireless password for separation.

Answer

Allow guest traffic to reach internal DNS and DHCP servers across all RFC1918 subnets.

Question 4

Employees must sign in to several SaaS applications with corporate credentials, and terminated users should lose access quickly without manual changes in each app. Which solution best meets the requirement?

Accepted Answer

Use federation for sign-on and automated provisioning and deprovisioning through an identity lifecycle process.. Federation enables single sign-on (SSO) using standards like SAML 2.0 or OIDC, allowing users to authenticate once with corporate credentials across multiple SaaS apps. Automated provisioning and deprovisioning via SCIM (System for Cross-domain Identity Management) ensures that when an employee is terminated, their access is revoked from all connected applications instantly without manual intervention, meeting the requirement for rapid access removal.

Answer

Create separate local usernames and passwords in each SaaS application.

Answer

Require users to share one department password for each SaaS platform.

Answer

Store the same password in every application vault and sync it nightly.

Question 5

Employees use a browser-based SaaS portal, a native expense app, and an internal API. The company wants one corporate identity, API access without separate passwords, and automatic account removal when HR disables a user. Which solution best fits?

Accepted Answer

Use OpenID Connect federation with OAuth 2.0 access tokens and SCIM provisioning.. OpenID Connect (OIDC) federation with OAuth 2.0 provides a single corporate identity (federated SSO), allows API access without separate passwords (using access tokens), and SCIM provisioning automates account removal when HR disables a user. This combination meets all three requirements: unified identity, passwordless API access, and lifecycle management.

Answer

Use LDAP binds directly against each application and manage local passwords separately.

Answer

Use shared local accounts in each application and sync passwords nightly from the directory.

Answer

Use Kerberos constrained delegation to each vendor tenant for every application.

Question 6

A company needs a public website that anyone on the internet can reach, but the application and database servers must stay off the internet. Where should the web server be placed?

Accepted Answer

In a DMZ separated from the internal application and database networks.. The web server must be placed in a DMZ (demilitarized zone) because this network segment is designed to host publicly accessible services while isolating them from internal networks. The DMZ allows inbound traffic from the internet to the web server, but the application and database servers remain on internal networks with strict firewall rules that block direct internet access, enforcing a layered security architecture.

Answer

On the internal user network with the database server.

Answer

On the same subnet as the firewall management interface.

Answer

Directly on the database subnet so performance is faster.

Question 7

A company uses a SaaS file-sharing platform for employee documents. Which action is the company's responsibility, not the provider's?

Accepted Answer

Setting user sharing permissions and access controls for company data.. In a SaaS model, the provider manages the underlying infrastructure, including application servers, storage, and hypervisors. The customer is responsible for configuring access controls and permissions for their own data within the application. Option B correctly identifies this shared responsibility boundary.

Answer

Patching the vendor's application servers.

Answer

Replacing failed disks in the provider's storage cluster.

Answer

Maintaining the cloud provider's identity center and hypervisor.

Question 8

Employees must sign in to several cloud applications with their corporate account, and terminated users should lose access without separate password resets in each app. What is the best solution?

Accepted Answer

Use federation with single sign-on from a central identity provider.. Federation with single sign-on (SSO) from a central identity provider (IdP) allows users to authenticate once using their corporate account, and the IdP issues security tokens (e.g., SAML assertions or OIDC tokens) that each cloud application trusts. When a user is terminated, the administrator disables the account in the IdP, and all applications immediately reject the user's tokens, eliminating the need for separate password resets in each app.

Answer

Create a separate local username and password in every cloud application.

Answer

Store the same shared password in a password manager for all applications.

Answer

Allow each application to authenticate users only by device MAC address.

Question 9

A company stores customer documents in cloud object storage. The provider already offers encryption at rest and physical security. Which action most directly reduces the risk of unauthorized access to the stored files?

Accepted Answer

Configure least-privilege IAM roles, bucket policies, and object permissions for approved users only.. Even with encryption at rest and physical security, unauthorized access can occur if IAM policies, bucket policies, and object permissions are overly permissive. Configuring least-privilege access ensures that only approved users can read or modify the stored files, directly reducing the attack surface. Encryption at rest protects data if storage media is compromised, but it does not prevent authorized users with excessive permissions from accessing files they shouldn't.

Answer

Assume the provider's default settings are sufficient because encryption at rest is already enabled.

Answer

Move the documents to a public bucket so users can access them without friction.

Answer

Disable encryption at rest so administrators can troubleshoot access problems more easily.

Question 10

A company wants employees to sign in once with corporate credentials and access multiple SaaS apps without creating separate passwords for each service. Which two features best support this goal? Select two.

Accepted Answer

Federation trust between the corporate identity provider and the SaaS provider.. Federation trust, typically implemented via standards like SAML 2.0 or OpenID Connect, establishes a trust relationship between the corporate identity provider (IdP) and each SaaS provider. This allows the SaaS app to accept authentication assertions from the corporate IdP, enabling users to sign in with their corporate credentials without needing separate passwords for each service.

Answer

Shared generic accounts for each department.

Answer

Storing the same password inside every SaaS application.

Answer

Disabling MFA so the sign-in process is faster.

Question 11

An HR system marks employees as hired, transferred, or terminated. The security team wants those changes to create, update, or disable accounts in multiple SaaS apps automatically after the user authenticates through the company identity provider. Which capability should be added?

Accepted Answer

SCIM provisioning integrated with the SSO platform.. SCIM (System for Cross-domain Identity Management) is the correct choice because it provides a standardized protocol for automating the creation, update, and deletion of user accounts across multiple SaaS applications. When integrated with an SSO platform (like SAML), SCIM handles the lifecycle events (hire, transfer, terminate) by sending RESTful API calls to each SaaS app, ensuring accounts are created, updated, or disabled without manual intervention. SAML alone only handles authentication, not account provisioning, making SCIM essential for the described automation.

Answer

SAML federation alone, with no additional account lifecycle automation.

Answer

Password synchronization between every application.

Answer

Local administrator groups on each SaaS application.

Question 12

Field staff use company-owned tablets that also run approved personal apps. Security wants corporate email and documents separated from personal data, with the ability to wipe only the work data if a device is lost. What is the best control?

Accepted Answer

Use a work profile or container managed by a mobile device management platform.. A work profile or container managed by a mobile device management (MDM) platform creates a separate, encrypted partition on the device for corporate data. This allows the organization to enforce policies and perform a selective wipe of only the work container without affecting personal apps or data, meeting the requirement for separation and targeted remote wipe.

Answer

Disable all personal apps by removing internet access from the tablet.

Answer

Install only a screen lock and require a longer PIN for the tablet.

Answer

Use a USB cable lock so the tablet cannot be physically moved.

Question 13

Administrators must manage network switches from home. Requirements: encrypted management traffic, MFA for users, no management ports exposed to the Internet, and centralized logging of admin sessions. Which solution best meets the requirements?

Accepted Answer

Use a VPN with MFA that terminates on a hardened jump host, then reach switches over SSH or HTTPS.. It satisfies all requirements: a VPN with MFA encrypts management traffic, the hardened jump host provides a secure intermediary that keeps switch management ports off the Internet, and centralized logging can be implemented on the jump host to record all admin sessions. This architecture aligns with the principle of defense-in-depth by combining encrypted tunnels, strong authentication, and network segmentation.

Answer

Open SSH directly on each switch and allow access from the entire Internet.

Answer

Use port forwarding through the firewall to RDP on each switch.

Answer

Build an IPSec tunnel only between office routers and share a common admin password on the switches.

Question 14

A team stores sensitive archives on cloud block storage. The provider already encrypts disks at rest, but the company wants copies of the disks to remain unreadable even if a cloud administrator can snapshot and mount the volume. Which control is best?

Accepted Answer

Use client-side encryption before upload and keep the keys in an external HSM or key service.. Client-side encryption ensures data is encrypted before it ever reaches the cloud provider's storage. By keeping the encryption keys in an external HSM or key service, the cloud provider (including its administrators) never has access to the plaintext keys, so even if they snapshot and mount the volume, the data remains unreadable. This addresses the threat model where the provider's own administrators could otherwise access the data at rest.

Answer

Enable provider-managed encryption at rest only and rotate the storage passwords monthly.

Answer

Place the storage account in a private subnet and block all Internet access.

Answer

Rely on immutable snapshots and versioning to prevent unauthorized access.

Question 15

Field technicians use company-owned tablets that also run approved personal apps. Security needs corporate email and documents isolated from personal data, selective wipe of only business content if a device is lost, and compliance checks before access is allowed. What should be deployed?

Accepted Answer

Mobile device management with a work profile or container and conditional access.. Mobile device management (MDM) with a work profile or container (e.g., Android Work Profile or iOS Managed Open In) provides the required isolation between corporate and personal data. Conditional access enforces compliance checks (e.g., device health attestation, OS patch level) before granting access to corporate resources. This combination also enables selective wipe of only the work container without affecting personal apps or data, meeting the lost-device requirement.

Answer

Full-disk encryption on the tablets with no additional device management.

Answer

A mobile VPN client with split tunneling enabled for user convenience.

Answer

An antivirus app with a blacklist of approved and unapproved mobile apps.