SY0-701 Security Architecture Practice Test 8 — 15 Questions

Question 1

An organization is redesigning access for its HR portal. HR staff need to update employee records, managers need to approve leave requests, and payroll staff need access to salary data, but no single user should receive all of those permissions by default. What is the best access model?

Accepted Answer

Create separate roles for HR, managers, and payroll, and grant only the permissions needed for each job function.. Option A is correct because Role-Based Access Control (RBAC) assigns permissions based on job functions, ensuring that HR staff, managers, and payroll personnel receive only the privileges necessary for their roles. This enforces the principle of least privilege and prevents any single user from inheriting all permissions by default, which aligns with the organization's security requirement.

Answer

Assign everyone the same portal permissions to simplify administration.

Answer

Give every manager full HR and payroll access so approvals are faster.

Answer

Use one shared administrator account for all HR actions to keep audits simple.

Question 2

A small company is publishing an internal website to the internet. The security team wants the web server reachable from the internet while keeping the database and file share isolated from direct internet access. Which design is best?

Accepted Answer

Place the web server in a DMZ and keep the database and file share on a private internal subnet.. Option B is correct because it implements a DMZ architecture where the web server is placed in a publicly accessible network segment, while the database and file share reside on a private internal subnet. This design ensures that even if the web server is compromised, an attacker cannot directly access the internal resources because firewall rules restrict inbound traffic to only the DMZ and block any initiated connections from the DMZ to the internal network. This follows the principle of defense in depth and network segmentation as recommended by CompTIA for securing multi-tier applications.

Answer

Place the web server and database on the same flat internal network behind the firewall.

Answer

Place the database in the DMZ and keep the web server on the internal user VLAN.

Answer

Use a VPN for all users and keep every server on the same subnet.

Question 3

A company wants to stop employees from running unauthorized tools downloaded from the internet on managed Windows laptops, but still allow approved internal apps and vendor-updated software. Which control is best?

Accepted Answer

Application control using an allowlist for approved executables and publishers.. Application control with an allowlist (also known as whitelisting) is the correct choice because it explicitly defines which executables, scripts, and publishers are permitted to run on managed Windows laptops. This prevents unauthorized tools downloaded from the internet from executing, while allowing approved internal apps and vendor-updated software that match the allowlist criteria. Technologies like Windows Defender Application Control (WDAC) or AppLocker enforce this by checking file hashes, publisher signatures, or path rules at runtime.

Answer

Full-disk encryption on every laptop before deployment.

Answer

A stronger screen-lock timeout and automatic logoff policy.

Answer

A firmware password for the BIOS without any other endpoint restrictions.

Question 4

A help desk team wants users to be unable to install unsanctioned browser extensions or freeware on corporate Windows laptops, while approved business apps still run. Which endpoint control is best?

Accepted Answer

Application allowlisting or application control.. Application allowlisting (or application control) is the correct endpoint control because it explicitly defines which software executables, scripts, and installers are permitted to run on the system. By default, all unapproved applications—including unsanctioned browser extensions and freeware—are blocked, while approved business apps are allowed to execute. This directly addresses the requirement to prevent unauthorized installations while maintaining normal operations for sanctioned software.

Answer

Full-disk encryption on every laptop.

Answer

A remote access VPN.

Answer

A desktop wallpaper policy.

Question 5

Several corporate laptops occasionally boot from a removable drive containing an untrusted recovery tool before Windows loads. The security team wants to reduce the chance of pre-boot tampering and unauthorized boot media use. Which two controls are most effective? Select two.

Accepted Answer

Enable UEFI Secure Boot.. UEFI Secure Boot ensures that only signed, trusted bootloaders and drivers are executed during the boot process. By verifying the digital signature of each component against a database of trusted keys, it prevents unauthorized boot media (such as an untrusted recovery tool) from loading before the operating system starts. This directly reduces the risk of pre-boot tampering and unauthorized boot media use.

Answer

Keep local administrator rights so users can recover faster.

Answer

Turn off disk encryption because it slows startup.

Answer

Move the laptops to a different subnet.

Question 6

A security team discovers that several laptops occasionally boot from a removable drive before Windows loads, allowing unapproved recovery tools to run. Management wants to prevent this with the least impact on normal users. Which control is the best fit?

Accepted Answer

Enable secure boot and restrict the firmware boot order so only the approved internal boot path is allowed.. Secure Boot ensures that only signed, trusted firmware and bootloaders execute during the startup process. By restricting the firmware boot order to the internal drive only, the laptop will ignore removable media during boot, preventing unapproved recovery tools from running before Windows loads. This has minimal impact on normal users because they can still use USB devices after the OS has booted.

Answer

Disable all USB ports permanently on every laptop.

Answer

Uninstall the endpoint protection agent and replace it with manual inspections.

Answer

Move user data to cloud storage so rogue boot media can no longer access it.

Question 7

A company uses several SaaS applications and wants employees to sign in once with a corporate account instead of maintaining separate passwords for each app. Which architecture is best?

Accepted Answer

Federated single sign-on with a central identity provider.. Federated single sign-on (SSO) with a central identity provider (IdP) allows users to authenticate once using their corporate account (e.g., via SAML 2.0 or OIDC) and then access multiple SaaS applications without re-entering credentials. The IdP issues a token that each SaaS app trusts, eliminating the need for separate passwords while maintaining centralized control over authentication policies.

Answer

Shared generic accounts for each department.

Answer

A separate username and password database in every SaaS application.

Answer

A site-to-site VPN for every SaaS vendor.

Question 8

A regulated analytics workload must run in the cloud with the strongest isolation from other customers, but the company does not want to manage its own physical server room. Which placement is most appropriate?

Accepted Answer

A dedicated host or equivalent single-tenant compute placement in the provider's environment.. Option C is correct because a dedicated host or single-tenant compute placement ensures that the physical server is not shared with any other customer, providing the strongest isolation required for regulated workloads. This model meets the compliance need for physical separation while still being a cloud service, so the company avoids managing its own server room.

Answer

A public subnet with an internet gateway so the workload can be reached directly.

Answer

A shared-tenancy virtual machine in the provider's default compute pool.

Answer

A serverless function because it removes all underlying infrastructure concerns.

Question 9

The help desk can patch endpoints only after testing on a few pilot systems because one legacy app sometimes breaks after updates. What patching approach is most secure and least disruptive?

Accepted Answer

Apply updates to a small pilot group first, then roll them out in stages to the rest of the fleet.. Option A is correct because it follows a phased rollout strategy: testing on a small pilot group first validates compatibility with the legacy app, then staged deployment minimizes disruption while ensuring security patches are applied promptly. This balances the need for security updates with the operational requirement to avoid breaking critical legacy software.

Answer

Wait until all applications are fully modernized before installing any security updates.

Answer

Patch every endpoint immediately at the same time without testing to reduce management overhead.

Answer

Disable automatic updates permanently and patch only after a confirmed incident.

Question 10

A company moves a Linux server to infrastructure as a service (IaaS). Which task remains the customer's responsibility?

Accepted Answer

Patching the guest operating system and installed applications.. In an IaaS model, the cloud provider manages the physical infrastructure, hypervisor, and network backbone, while the customer retains responsibility for securing and maintaining the guest operating system and any installed applications. This includes applying security patches, updating software, and configuring the OS-level firewall. For a Linux server, the customer must run commands like `apt update && apt upgrade` or `yum update` to patch the OS and manage application dependencies.

Answer

Replacing failed power supplies in the data center.

Answer

Maintaining the hypervisor on the host system.

Answer

Building and securing the provider's network backbone.

Question 11

A small company is redesigning its network for a public web application. The web front end must be reachable from the internet, but the database should never be exposed directly to external or general user traffic. Which architecture is the best choice?

Accepted Answer

Place the web server in a DMZ and keep the database in a private internal subnet with only required application traffic allowed.. Option B is correct because it implements a layered security architecture: the web server resides in a DMZ (demilitarized zone) where it is reachable from the internet, while the database is placed in a private internal subnet with strict firewall rules that only allow the required application traffic (e.g., TCP port 3306 for MySQL or 1433 for MSSQL) from the web server. This ensures the database is never directly exposed to external or general user traffic, reducing the attack surface and preventing direct internet-based attacks on the database.

Answer

Place both the web server and database in the same internal subnet and rely on host firewalls.

Answer

Place the database in the DMZ so the web server can query it directly without internal routing.

Answer

Keep both systems public but restrict access with NAT and strong administrator passwords.

Question 12

A company wants employees to use their normal login from managed devices but require extra verification when they sign in from an unmanaged laptop or a new location. Which two controls should the team use? Select two.

Accepted Answer

Conditional access. Conditional access (A) is correct because it allows the company to define policies that grant or block access based on conditions such as device compliance (managed vs. unmanaged) and location (trusted vs. new). Multi-factor authentication (B) is correct because it provides the extra verification step required when the conditional access policy detects an unmanaged laptop or a new location, ensuring the user proves their identity beyond just a password.

Answer

DNS filtering

Answer

Disk encryption

Answer

Port security

Question 13

A regulated workload must run in the cloud with the strongest possible isolation from other tenants, and the company wants to avoid managing its own physical hardware. Which placement is the best fit?

Accepted Answer

Use a dedicated host so the underlying hardware is allocated to one customer only.. A dedicated host provides the strongest possible isolation by ensuring that the physical server is not shared with any other tenant. This meets the requirement for a regulated workload without the company managing its own hardware, as the cloud provider still handles maintenance and patching.

Answer

Use a shared tenancy instance with tighter security groups and a private subnet.

Answer

Move the workload into a public subnet so the provider can inspect traffic more easily.

Answer

Use a container within a shared platform because containers always isolate tenants completely.

Question 14

An HR portal has three job functions: HR staff update employee records, managers approve leave requests, and payroll views salary data. The security team wants to prevent any one role from having all capabilities. Which access design is the best fit?

Accepted Answer

Create role-based access groups aligned to each job function and grant only the permissions needed for that role.. Role-based access control (RBAC) is the correct design because it enforces the principle of least privilege by granting each job function only the permissions necessary for its tasks. This prevents any single role from accumulating all capabilities (e.g., HR staff cannot approve leave or view salary data), directly addressing the security team's requirement to separate duties. RBAC aligns with NIST SP 800-53 AC-6 and is a standard access control model for multi-role enterprise applications.

Answer

Use a single superuser account for the entire department so tasks can be completed quickly.

Answer

Give every employee access to all portal features and depend on audit logs to catch mistakes later.

Answer

Require the payroll team to share one common password and use it only from the office network.

Question 15

An HR portal has three groups: HR staff can edit employee records, managers can approve leave, and payroll can view salary data. No one should have all functions. Which access model should the engineer implement?

Accepted Answer

Role-based access control with separate groups mapped to each business function.. Option A is correct because Role-Based Access Control (RBAC) allows the engineer to define three distinct roles (HR staff, managers, payroll) with granular permissions mapped to specific business functions, ensuring no single user inherits all privileges. This model enforces the principle of least privilege by separating duties across groups, preventing any user from having full access to the portal's sensitive operations.

Answer

A single shared admin account so all tasks can be completed quickly.

Answer

Mandatory access control with all users assigned the same clearance level.

Answer

Local account creation on the portal for each user, with permissions assigned manually one by one.