SY0-701 Security Architecture Practice Test 9 — 15 Questions

Question 1

Match each traffic control to the best description.

Question 2

A help desk team manages 300 Windows laptops. A legacy accounting app sometimes fails after updates, so the company wants to reduce patch risk while still preventing long-term exposure. Which patching strategy is the best balance?

Accepted Answer

Use a pilot group and phased rollout process before wider deployment.. A phased rollout with a pilot group is the most balanced approach. It allows the team to test new patches on a few systems that reflect the production environment before exposing the entire fleet to possible compatibility issues. That lowers operational risk while still ensuring the organization patches regularly, which is essential for reducing exposure to known vulnerabilities and maintaining a secure baseline.

Why others are wrong: Option A is too labor-intensive and still lacks controlled validation. Option C accepts avoidable risk by deferring all updates indefinitely. Option D is reactive and leaves the fleet exposed until an incident occurs. The correct answer is the only one that preserves security and operational stability at the same time.

Answer

Apply updates manually to each laptop as soon as they are released.

Answer

Postpone all updates until the legacy accounting app is replaced.

Answer

Disable automatic updates permanently and patch only after a security incident.

Question 3

A finance team deploys a regulated workload to a public cloud. They want operating system login events, process activity, and network flow metadata to be retained in one central place for detection and investigation. Which action best supports this requirement with the least operational overhead?

Accepted Answer

Enable cloud-native logging and forward guest telemetry from the workload into a centralized security logging service or SIEM.. Option B is correct because it directly addresses the requirement to centralize OS login events, process activity, and network flow metadata from a public cloud workload. Cloud-native logging (e.g., AWS CloudTrail, Azure Monitor) can capture guest OS telemetry via agents (e.g., Amazon CloudWatch Agent, Azure Log Analytics agent) and forward it to a centralized security logging service or SIEM, minimizing operational overhead by leveraging built-in cloud services rather than custom infrastructure.

Answer

Rely on the cloud provider to automatically secure all guest operating systems and collect every log type by default.

Answer

Move the workload to a private data center so the cloud provider can no longer access any telemetry.

Answer

Disable host logging and rely only on perimeter firewall logs to reduce storage costs.

Question 4

A company wants its laptop fleet to start from a known configuration before shipping to users and to reduce exposure to newly discovered vulnerabilities over time. Which two actions are best? Select two.

Accepted Answer

Build the laptops from a secure baseline image.. Building laptops from a secure baseline image ensures that every device starts with a known, hardened configuration, eliminating any pre-existing vulnerabilities or misconfigurations. This directly supports the requirement to begin from a known good state before shipping to users.

Answer

Install extra consumer applications by default.

Answer

Allow users to disable endpoint protection whenever they want.

Answer

Delay firmware updates until devices fail.

Question 5

A regulated analytics workload must run in a public cloud with the strongest practical tenant isolation while avoiding management of physical servers. The workload should also remain off the public internet. Which two deployment choices best fit? Select two.

Accepted Answer

Run the workload on a dedicated host or dedicated instance.. A dedicated host or dedicated instance provides the strongest practical tenant isolation in a public cloud by ensuring that the underlying physical server is not shared with any other customer. This meets the regulatory requirement for strong isolation while avoiding the need to manage physical servers, as the cloud provider still handles hardware maintenance. The dedicated instance model (e.g., AWS Dedicated Instances) offers hardware-level isolation at the instance level, while a dedicated host gives you visibility and control over the physical server, both without requiring you to manage the server itself.

Answer

Use shared tenancy with security groups only.

Answer

Assign an elastic IP so administrators can reach the workload directly from anywhere.

Answer

Expose the workload through a public load balancer to simplify connectivity.

Question 6

A branch office uses a flat LAN, and a compromise on one user workstation could spread quickly to finance systems. Management wants finance workstations isolated from general users, but finance staff still need access to a central finance application and network printer. What is the best design change?

Accepted Answer

Create separate VLANs for finance and user devices, then apply inter-VLAN ACLs to allow only required application and printer traffic.. Option B is correct because creating separate VLANs segments the flat LAN into isolated broadcast domains, preventing lateral movement from compromised user workstations to finance systems. Inter-VLAN ACLs then act as a stateful firewall, permitting only the specific traffic (e.g., TCP 1433 for SQL-based finance app, TCP 9100 for printer) while blocking all other inter-VLAN communication. This aligns with the principle of least privilege and network segmentation, directly addressing the requirement to isolate finance workstations without disrupting their needed access.

Answer

Move finance devices to the guest Wi-Fi network so they are separated from employees.

Answer

Keep the flat LAN but require stronger passwords on finance PCs and shared folders.

Answer

Place all devices in one VLAN and rely on endpoint antivirus to stop spread.

Question 7

A company moved an internal application to a cloud virtual machine. The security team wants operating system login events, process activity, and network flow metadata to be available in the SIEM for investigations. Which action best supports that goal?

Accepted Answer

Enable guest OS audit logging and cloud-native flow logs, then forward the data to the SIEM.. Option B is correct because it directly addresses the requirement to collect operating system login events, process activity, and network flow metadata. Enabling guest OS audit logging (e.g., via Windows Event Log or syslog) captures login and process events, while cloud-native flow logs (e.g., AWS VPC Flow Logs or Azure NSG flow logs) provide network flow metadata. Forwarding both data streams to the SIEM ensures centralized visibility for investigations.

Answer

Rely only on the cloud provider's service health dashboard and billing alerts.

Answer

Encrypt the virtual machine disks and disable all logging to reduce exposure.

Answer

Install only a web application firewall because that covers server log collection.

Question 8

A company manages 300 laptops and wants to reduce risk from missed patches while avoiding a widespread outage if an update has compatibility issues. Which patching approach is the best choice?

Accepted Answer

Use a phased rollout with a pilot group, then expand deployment after validation, while keeping a standard baseline configuration.. Option C is correct because a phased rollout with a pilot group allows the IT team to validate patches on a small subset of laptops before full deployment, reducing the risk of widespread outages from compatibility issues. Maintaining a standard baseline configuration ensures consistency across all 300 laptops, which simplifies patch management and reduces the likelihood of missed patches. This approach balances risk mitigation with operational continuity, aligning with best practices for enterprise patch management.

Answer

Install patches manually on each laptop after users report problems.

Answer

Deploy all patches to every laptop immediately with no testing.

Answer

Wait for annual maintenance windows so all changes happen at once.

Question 9

Employees use several SaaS applications, and the security team wants one corporate login, MFA for unmanaged devices, and centralized account provisioning. Which architecture should be used?

Accepted Answer

Use federated single sign-on with the corporate identity provider and conditional access policies.. Federated single sign-on (SSO) with a corporate identity provider (IdP) allows users to authenticate once using their corporate credentials and access multiple SaaS applications without separate logins. Conditional access policies can enforce MFA specifically for unmanaged devices, and centralized account provisioning (e.g., via SCIM) ensures accounts are created, updated, and deprovisioned from a single directory. This architecture meets all three requirements: single corporate login, MFA for unmanaged devices, and centralized provisioning.

Answer

Create separate usernames and passwords for each SaaS application.

Answer

Share one generic account for the team so access is easier to audit.

Answer

Put all users on a VPN and let each SaaS application trust the internal network automatically.

Question 10

A security team wants to reduce the chance that employees boot unmanaged tools from removable media and wants only approved software to run on laptops. Which two controls should they use? Select two.

Accepted Answer

Secure Boot. Secure Boot is correct because it ensures that only signed, trusted firmware and bootloaders execute during system startup, preventing unauthorized bootable media (e.g., USB drives with unmanaged OS images) from loading. This directly reduces the chance that employees can boot unmanaged tools from removable media by enforcing a chain of trust from UEFI firmware to the operating system kernel.

Answer

DNS forwarding

Answer

Longer screen-lock timeout

Answer

Public DNS resolvers

Question 11

A branch office has users, finance workstations, printers, and IP phones on one flat LAN. After a malware outbreak on a user PC, management wants to limit lateral movement without blocking printing or voice traffic. What should the network team implement?

Accepted Answer

Create separate VLANs for device groups and apply inter-VLAN ACLs that permit only required traffic.. Option B is correct because segmenting devices into separate VLANs (e.g., users, finance, printers, IP phones) and applying inter-VLAN ACLs restricts lateral movement by default while permitting only necessary traffic like printing (TCP 9100) and voice (RTP/UDP 16384-32767). This aligns with the principle of least privilege and zero trust segmentation, preventing malware from spreading across the flat LAN without disrupting critical services.

Answer

Move all devices into one larger subnet and rely on endpoint antivirus for separation.

Answer

Place all devices behind a single proxy server and block all internal east-west traffic.

Answer

Enable port security on the switch and disable all VLAN tagging to reduce complexity.

Question 12

A finance workflow currently lets one employee create a payment batch and approve it in the same session. Audit findings say the design increases fraud risk. Which two access architecture changes best reduce that risk while keeping the process functional? Select two.

Accepted Answer

Split the workflow into separate creator and approver roles.. Option A is correct because implementing separation of duties (SoD) by splitting the payment batch creation and approval into distinct roles ensures that no single user can both create and approve a transaction. This directly mitigates the fraud risk identified in the audit by requiring collusion between two users to execute a fraudulent payment. The process remains functional because the workflow is simply reordered into two sequential steps performed by different users.

Answer

Grant all finance users local administrator rights to speed up exception handling.

Answer

Store the payment password in a shared mailbox so the team can continue when someone is absent.

Answer

Remove approval steps entirely and rely on log reviews after payment runs.

Question 13

A small company is deploying a public web application with a front-end server, an application server, and a database. Which two design choices best reduce exposure of the backend systems? Select two.

Accepted Answer

Place the web server in a DMZ that is reachable from the internet.. Option A is correct because placing the web server in a DMZ (demilitarized zone) allows it to be reachable from the internet while isolating it from the internal network. This design ensures that even if the web server is compromised, an attacker cannot directly access the application server or database, as traffic must pass through a firewall with strict rules. The DMZ acts as a buffer zone, reducing the attack surface of backend systems.

Answer

Put the database on the same subnet as the web server for faster communication.

Answer

Allow every tier to communicate freely to simplify troubleshooting.

Answer

Use one flat VLAN for all three servers and rely on strong passwords.

Question 14

A development team is moving a regulated application to a cloud platform. The security architect wants the strongest practical separation from other customers without buying and operating physical servers. Which hosting option is most appropriate?

Accepted Answer

A dedicated host or isolated compute offering from the cloud provider.. A dedicated host or isolated compute offering (option B) provides the strongest practical separation because it ensures the application runs on a physical server dedicated solely to that customer, preventing any resource sharing or potential side-channel attacks from other tenants. This meets the regulatory requirement for strong isolation without the cost and operational overhead of purchasing and managing physical servers on-premises.

Answer

A shared multi-tenant environment with no additional security configuration.

Answer

Any public object storage service because the data will be encrypted by default.

Answer

A remote desktop service on the cheapest shared instance available.

Question 15

Based on the exhibit, which action best addresses both the unsanctioned software problem and the need for consistent endpoint configuration?

Exhibit:
Device group: Sales-Laptops
Baseline check:
- Approved browser: installed
- Approved EDR: installed
- Unapproved remote admin tool: detected on 14 endpoints
- Local administrator rights: granted to all users in group
- Patch compliance: 68%

Management wants to prevent unauthorized software from running and keep future builds consistent.

Accepted Answer

Deploy application allowlisting through centralized endpoint management and remove local administrator rights.. Option A is correct because application allowlisting (via AppLocker or Windows Defender Application Control) centrally enforces which software can run, directly addressing the unsanctioned remote admin tool. Removing local administrator rights prevents users from bypassing the allowlist or making unauthorized configuration changes, ensuring consistent endpoint builds and improving patch compliance by limiting user-driven modifications.

Answer

Keep users as local admins but require stronger email passwords for better overall security.

Answer

Disable the EDR agent during software installs to avoid false alerts from approved apps.

Answer

Store approved installers on a shared drive and let users choose what to install.