SY0-701 Security Architecture Practice Test 8 — 15 Questions

Question 1

A manufacturer wants to give partner-company users access to a procurement portal. The partner wants to authenticate its own users, and the manufacturer does not want to create separate local passwords for them. What is the best solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Federate access with the partner's identity provider and map claims or attributes to portal roles.. Federation with the partner's identity provider (IdP) using standards like SAML 2.0 or OIDC allows the partner to authenticate their own users while the manufacturer's portal trusts those assertions. Claims or attributes from the IdP (e.g., group membership) are mapped to portal roles, eliminating the need for local passwords and enabling single sign-on (SSO). This is the best solution because it maintains security boundaries and offloads authentication management to the partner.

Answer

Create shared portal accounts and distribute credentials to the partner's staff.

Answer

Issue one VPN account for the partner organization and let them share it internally.

Answer

Require each partner user to create a password directly in the procurement portal.

Question 2

A team manages virtual machines in a public cloud and wants an audit trail of who created instances, changed security groups, and modified IAM settings. What should be enabled first?

Accepted Answer

Cloud control plane or audit logging.. Cloud control plane or audit logging (e.g., AWS CloudTrail, Azure Monitor, or Google Cloud Audit Logs) captures all API calls that create instances, modify security groups, or change IAM settings. This provides the required audit trail of who performed each action, when, and from what source, which is essential for security incident response and compliance.

Answer

Host-based antivirus on each virtual machine.

Answer

A guest operating system screen saver policy.

Answer

A static public IP address for every virtual machine.

Question 3

Based on the exhibit, which network change best isolates finance workstations from general user PCs while still allowing printing and application access?

VLAN table:
- VLAN 20 Users: 10.20.20.0/24
- VLAN 30 Finance: 10.20.30.0/24
- VLAN 40 Printers: 10.20.40.0/24
- VLAN 50 Accounting App: 10.20.50.0/24

Current SVI routing policy:
permit ip any any

Management goal:
Finance devices must not initiate traffic to User VLAN 20, but they must be able to print and access the accounting application.

Accepted Answer

Add inter-VLAN ACLs that deny Finance VLAN access to User VLAN 20 while permitting Finance VLAN traffic to VLAN 40 and VLAN 50.. It uses inter-VLAN ACLs to enforce the principle of least privilege: denying traffic from the Finance VLAN (10.20.30.0/24) to the User VLAN (10.20.20.0/24) while explicitly permitting traffic to the Printer VLAN (10.20.40.0/24) and the Accounting App VLAN (10.20.50.0/24). This preserves the required segmentation and still allows the necessary services (printing and application access) without altering the existing VLAN structure or routing policy.

Answer

Put finance workstations on the same VLAN as the printers to simplify access.

Answer

Remove routing between all VLANs and let users print through email attachments.

Answer

Place the accounting application in the User VLAN so finance devices no longer need segmentation.

Question 4

A regulated analytics workload is moving to a public cloud. The business wants the strongest practical tenant isolation without managing physical servers, and it also needs an audit trail for changes made to the cloud environment. Which two design choices best meet those requirements? Select two.

Accepted Answer

Place the workload in a dedicated account, project, or subscription with restricted cross-account access.. Placing the workload in a dedicated account, project, or subscription with restricted cross-account access provides strong logical isolation at the cloud provider's control plane. This approach meets the requirement for tenant isolation without managing physical servers, as it leverages the provider's built-in resource boundaries and IAM policies to prevent unauthorized access between tenants.

Answer

Deploy the workload in a shared public subnet to simplify routing between tenants.

Answer

Assume the cloud provider will record every guest operating system event automatically.

Answer

Disable logging to reduce storage costs because the provider already has all necessary records.

Question 5

A help desk manager is hardening a fleet of Windows laptops. The goal is to prevent booting from untrusted external media and to ensure only approved software can run on the devices. Which two controls best address those goals? Select two.

Accepted Answer

Enable Secure Boot in firmware.. Secure Boot is a UEFI firmware feature that verifies the digital signature of the bootloader against a database of trusted signatures stored in the firmware. By enabling Secure Boot, the system will refuse to boot from any external media (e.g., USB drives) that does not have a valid, trusted signature, directly preventing unauthorized boot code from executing.

Answer

Rely only on full-disk encryption to stop unauthorized boot code.

Answer

Increase the screen-lock timeout so users are interrupted less often.

Answer

Use a stronger Wi-Fi password so malware cannot start.

Question 6

A small enterprise is rebuilding its public customer portal. The web front end must be reachable from the internet, the application tier should never be directly exposed, and the database must remain private even if the web server is compromised. Which two design changes best meet those goals? Select two.

Accepted Answer

Place the web front end in a DMZ behind a firewall rule allowing only HTTPS from the internet.. Placing the web front end in a DMZ behind a firewall rule that permits only HTTPS (TCP/443) from the internet ensures the public-facing component is isolated from internal networks. This design prevents direct inbound access to the application or database tiers, reducing the attack surface while still allowing legitimate web traffic.

Answer

Put the database on the same subnet as the web front end so internal calls have lower latency.

Answer

Allow the database to accept connections from the internet if strong passwords are used.

Answer

Disable all inbound filtering on the DMZ so troubleshooting is simpler.

Question 7

A laptop repeatedly starts with an unapproved bootloader, and the security team wants the firmware to refuse boot code that is not signed by a trusted key. Which feature should be used?

Accepted Answer

Secure Boot.. Secure Boot is a UEFI firmware feature that verifies the digital signature of bootloaders and kernel code against a database of trusted keys before allowing execution. By configuring Secure Boot to only accept boot code signed by a trusted key, the firmware will reject any unapproved bootloader, preventing unauthorized code from running during the boot process.

Answer

BitLocker full-disk encryption.

Answer

A DHCP reservation.

Answer

A local administrator password policy.

Question 8

A small company is deploying a public web application with a front-end server, an API server, and a database. The web server must be reachable from the internet, the API must be reachable only from the web server, and the database must never be accessible from user subnets. Which design best meets the requirement?

Accepted Answer

Place the web server in a DMZ, the API server in an internal subnet, and the database in a separate restricted subnet.. It implements a layered security architecture: the web server resides in a DMZ (demilitarized zone) to be publicly accessible, the API server is placed in an internal subnet with firewall rules allowing only traffic from the web server, and the database is isolated in a restricted subnet with no access from user subnets. This design enforces the principle of least privilege and prevents direct internet exposure of the API and database, which is critical for protecting sensitive data.

Answer

Place all three servers on the same internal VLAN and use host firewalls only.

Answer

Place the database in the DMZ so the web server can connect to it with fewer firewall rules.

Answer

Use a single NAT gateway for all servers and rely on public IP filtering at the edge.

Question 9

A company wants employees to use one corporate login for multiple SaaS applications, require MFA when users sign in from unmanaged devices, and centralize account lifecycle management. Which design best meets these requirements?

Accepted Answer

Implement federated single sign-on through a central identity provider with MFA and conditional access policies.. Federated single sign-on (SSO) through a central identity provider (IdP) like Microsoft Entra ID or Okta allows employees to use one corporate login across multiple SaaS applications via protocols such as SAML 2.0 or OIDC. The IdP enforces MFA for unmanaged devices through conditional access policies (e.g., device compliance checks) and centralizes account lifecycle management by provisioning/deprovisioning users from a single directory (e.g., LDAP or SCIM).

Answer

Create separate local usernames and passwords in each SaaS application.

Answer

Use shared accounts for each department and keep one password vault for the team.

Answer

Require all users to connect through a VPN before any SaaS login and remove identity federation.

Question 10

A SaaS vendor hosts a customer relationship platform for multiple organizations. Your company wants to know which two responsibilities typically remain with the customer rather than the SaaS provider. Select two.

Accepted Answer

Assigning user roles and approving access within the tenant.. In a SaaS model, the customer retains administrative control over user identities, roles, and access permissions within their own tenant. The SaaS provider manages the underlying application and infrastructure, but the customer must configure role-based access control (RBAC) to enforce least privilege and approve access requests. This aligns with the shared responsibility model where identity and access management (IAM) at the application layer falls to the customer.

Answer

Patching the provider's underlying database engine.

Answer

Maintaining the vendor's physical data center power and cooling.

Answer

Replacing the provider's hypervisors during maintenance windows.

Question 11

A team is moving a workload to infrastructure as a service (IaaS). Which two items are usually the customer's responsibility? Select two.

Accepted Answer

Patch the guest operating system running on the cloud virtual machine.. In an IaaS model, the customer is responsible for managing the guest operating system, including applying security patches and updates. This is because the cloud provider only manages the underlying physical infrastructure and hypervisor, while the customer controls the OS and applications running on the virtual machine.

Answer

Replace failed power supplies in the cloud provider's data center.

Answer

Maintain the cloud provider's hypervisor firmware.

Answer

Manage the physical firewall blades inside the provider's facility.

Question 12

A company wants employees to sign in once to several SaaS apps, while the security team also wants to require extra verification when users sign in from unmanaged devices or unusual locations. Which two architecture changes best satisfy both requirements? Select two.

Accepted Answer

Federate authentication to a central identity provider.. Federating authentication to a central identity provider (IdP) enables single sign-on (SSO) across multiple SaaS apps using standards like SAML 2.0 or OIDC. This allows employees to sign in once, while the IdP becomes a centralized point to enforce additional security controls.

Answer

Create separate passwords for each SaaS app so compromise is contained.

Answer

Turn off MFA because single sign-on already reduces logins.

Answer

Use shared generic accounts for contractors to simplify onboarding.

Question 13

Based on the exhibit, which logging capability should be enabled first to create an audit trail for cloud administration changes?

Exhibit:
2026-04-25 09:14:03  iam:AttachRolePolicy  user=alice
2026-04-25 09:15:10  ec2:AuthorizeSecurityGroupIngress  user=alice
2026-04-25 09:16:22  s3:PutBucketPolicy  user=alice

Requirement:
Security wants to track management-plane API calls and configuration changes across cloud resources.

Accepted Answer

Enable cloud control-plane audit logging such as CloudTrail or the provider equivalent.. Cloud control-plane audit logging (e.g., AWS CloudTrail, Azure Monitor, or GCP Cloud Audit Logs) captures all management-plane API calls—such as IAM role attachments, security group rule changes, and bucket policy modifications—as shown in the exhibit. This directly meets the requirement to track configuration changes across cloud resources, providing a tamper-proof audit trail for security and compliance.

Answer

Install a rootkit detector on each workload and ignore management-plane activity.

Answer

Capture only DNS traffic, because it reveals all admin changes indirectly.

Answer

Rely on manual change tickets in a spreadsheet because cloud platforms do not record useful logs.

Question 14

A team moved a Linux VM to IaaS. They need OS login events, process activity, and network flow metadata sent to one central platform for alerting. What is the best first step?

Accepted Answer

Deploy an endpoint logging agent and enable cloud-native flow logs to a centralized logging service.. Deploying an endpoint logging agent (e.g., auditd, osquery, or a SIEM agent) on the Linux VM captures OS login events and process activity at the guest level, while enabling cloud-native flow logs (e.g., AWS VPC Flow Logs, Azure NSG flow logs) provides network flow metadata. Sending both to a centralized logging service (e.g., AWS CloudWatch Logs, Azure Log Analytics, or a third-party SIEM) ensures all required telemetry is aggregated for alerting. This approach directly addresses the need for host-level and network-level visibility without relying on the cloud provider to collect guest OS internals.

Answer

Enable only perimeter security groups and assume the cloud provider will collect all host telemetry.

Answer

Store the VM snapshots in object storage and review them manually during incidents.

Answer

Rely on the hypervisor console and disable guest-level logging to reduce overhead.

Question 15

Based on the exhibit, which identity architecture change best addresses the repeated password resets and delayed offboarding across the company's SaaS applications?

Exhibit:
- SaaS A uses local user accounts
- SaaS B uses local user accounts
- SaaS C supports SAML and automated provisioning
- Help desk reports 120 password reset tickets per month
- Former employees can remain active in two apps for up to 24 hours after termination

Management wants one sign-in and faster deprovisioning.

Accepted Answer

Implement federated SSO with the enterprise identity provider and automated provisioning for SaaS users.. Implementing federated SSO with the enterprise identity provider (IdP) centralizes authentication, allowing users to sign in once. Combined with automated provisioning (SCIM), it enables near-instant deprovisioning when an employee is terminated, eliminating the 24-hour delay and reducing password reset tickets by removing the need for local account management.

Answer

Create one shared account for each application and store the passwords in a vault.

Answer

Keep local accounts in every SaaS app and reset passwords whenever staff change roles.

Answer

Put the SaaS apps behind a network firewall and use source IP filtering instead of identity.