SY0-701 Security Architecture Practice Test 9 — 15 Questions

Question 1

Based on the exhibit, which logging capability should be enabled first to create an audit trail for cloud administration changes?

Exhibit:
2026-04-25 09:14:03  iam:AttachRolePolicy  user=alice
2026-04-25 09:15:10  ec2:AuthorizeSecurityGroupIngress  user=alice
2026-04-25 09:16:22  s3:PutBucketPolicy  user=alice

Requirement:
Security wants to track management-plane API calls and configuration changes across cloud resources.

Accepted Answer

Enable cloud control-plane audit logging such as CloudTrail or the provider equivalent.. Cloud control-plane audit logging (e.g., AWS CloudTrail, Azure Monitor, or GCP Cloud Audit Logs) captures all management-plane API calls—such as IAM role attachments, security group rule changes, and bucket policy modifications—as shown in the exhibit. This directly meets the requirement to track configuration changes across cloud resources, providing a tamper-proof audit trail for security and compliance.

Answer

Install a rootkit detector on each workload and ignore management-plane activity.

Answer

Capture only DNS traffic, because it reveals all admin changes indirectly.

Answer

Rely on manual change tickets in a spreadsheet because cloud platforms do not record useful logs.

Question 2

A team moved a Linux VM to IaaS. They need OS login events, process activity, and network flow metadata sent to one central platform for alerting. What is the best first step?

Accepted Answer

Deploy an endpoint logging agent and enable cloud-native flow logs to a centralized logging service.. Deploying an endpoint logging agent (e.g., auditd, osquery, or a SIEM agent) on the Linux VM captures OS login events and process activity at the guest level, while enabling cloud-native flow logs (e.g., AWS VPC Flow Logs, Azure NSG flow logs) provides network flow metadata. Sending both to a centralized logging service (e.g., AWS CloudWatch Logs, Azure Log Analytics, or a third-party SIEM) ensures all required telemetry is aggregated for alerting. This approach directly addresses the need for host-level and network-level visibility without relying on the cloud provider to collect guest OS internals.

Answer

Enable only perimeter security groups and assume the cloud provider will collect all host telemetry.

Answer

Store the VM snapshots in object storage and review them manually during incidents.

Answer

Rely on the hypervisor console and disable guest-level logging to reduce overhead.

Question 3

Based on the exhibit, which identity architecture change best addresses the repeated password resets and delayed offboarding across the company's SaaS applications?

Exhibit:
- SaaS A uses local user accounts
- SaaS B uses local user accounts
- SaaS C supports SAML and automated provisioning
- Help desk reports 120 password reset tickets per month
- Former employees can remain active in two apps for up to 24 hours after termination

Management wants one sign-in and faster deprovisioning.

Accepted Answer

Implement federated SSO with the enterprise identity provider and automated provisioning for SaaS users.. Implementing federated SSO with the enterprise identity provider (IdP) centralizes authentication, allowing users to sign in once. Combined with automated provisioning (SCIM), it enables near-instant deprovisioning when an employee is terminated, eliminating the 24-hour delay and reducing password reset tickets by removing the need for local account management.

Answer

Create one shared account for each application and store the passwords in a vault.

Answer

Keep local accounts in every SaaS app and reset passwords whenever staff change roles.

Answer

Put the SaaS apps behind a network firewall and use source IP filtering instead of identity.

Question 4

Match each cloud security concept to the best description.

Accepted Answer

Encryption: Protects data by converting it into a secure format.. Each cloud security concept is matched to its primary function: encryption protects data at rest or in transit, IAM manages access, SIEM provides event analysis, IDS detects intrusions, and DLP prevents data loss.

Answer

Encryption: Manages user access to resources.

Answer

IAM: Protects data by encoding it.

Question 5

Match each network segment to the best use in a small enterprise.

Accepted Answer

Guest Wi-Fi: Used for external users to access the internet without accessing internal resources.. Each segment serves a specific purpose: guest Wi-Fi for external users, DMZ for public services, internal LAN for daily operations, management for device control, data center for core infrastructure, VPN for secure remote access.

Answer

VPN: Used for managing network devices (switches, routers).

Answer

Management: Provides secure remote access to internal network for employees.

Question 6

A branch office has users, finance workstations, and printers on the same LAN. Management wants finance devices isolated from general users while still allowing approved printing and internet access. Which two changes best meet this goal? Select two.

Accepted Answer

Put finance systems in a separate VLAN.. Placing finance systems in a separate VLAN (Option A) segments the LAN into isolated broadcast domains, preventing general users from directly accessing finance workstations at Layer 2. This is a foundational step for network segmentation, as VLANs logically separate traffic without requiring physical re-cabling.

Answer

Remove the default gateway from all finance devices.

Answer

Place all systems in one flat subnet.

Answer

Use hubs instead of switches to simplify traffic flow.

Question 7

A branch office has users, finance workstations, printers, and IP phones on one flat network. The security team wants to reduce lateral movement if one user PC is compromised, but printers still need to receive print jobs from users. What is the best design change?

Accepted Answer

Place finance systems and user devices in separate VLANs and allow only the necessary print and business application traffic through filtering rules.. Segmenting the flat network into separate VLANs for finance systems and user devices enforces network segmentation, which limits lateral movement. By using VLANs and firewall rules to allow only necessary traffic (e.g., print jobs via IPP or SMB, and business application traffic), the organization reduces the attack surface while maintaining required functionality. This aligns with the principle of least privilege and zero trust architecture.

Answer

Keep one flat network and increase endpoint antivirus scanning frequency.

Answer

Move all printers into the finance VLAN to avoid managing inter-VLAN rules.

Answer

Disable printing so user workstations cannot communicate with any other device.

Question 8

Based on the exhibit, which cloud deployment choice best satisfies the workload requirements?

Exhibit:
Workload requirements:
- Processes regulated customer records
- Should not share underlying compute with other tenants if avoidable
- Team wants provider-managed hardware maintenance
- Application will run in a public cloud

Which deployment choice is the best fit?

Accepted Answer

Public cloud with a dedicated host or equivalent single-tenant compute placement.. A dedicated host or single-tenant compute placement in a public cloud ensures the workload does not share underlying physical hardware with other tenants, meeting the 'should not share underlying compute' requirement. It also provides provider-managed hardware maintenance and runs in a public cloud, aligning with all stated workload requirements for processing regulated customer records.

Answer

Shared public tenancy on standard virtual machines.

Answer

Community cloud shared with other regulated organizations.

Answer

On-premises private cloud with company-owned servers and full hardware management.

Question 9

A company wants visibility into who changed settings in its cloud account and what commands ran on a cloud VM. Which two log sources should the team enable first? Select two.

Accepted Answer

Cloud provider audit or API logs. Cloud provider audit or API logs (Option A) capture all changes made to the cloud account via the provider's management plane, including who modified settings and when. Guest operating system event logs (Option B) record commands executed within the VM itself, such as PowerShell or bash commands, providing visibility into runtime activities. Together, these two sources cover both the control plane (account-level changes) and data plane (VM-level commands) for comprehensive monitoring.

Answer

Printer spooler logs

Answer

Browser history from employees' home PCs

Answer

DHCP lease logs from the office router

Question 10

A company wants employees to sign in once to access several SaaS applications, but it also wants to require MFA only when users connect from unmanaged devices or outside the corporate network. Which architecture best supports this goal?

Accepted Answer

Implement federated identity with single sign-on and conditional access policies tied to device posture and network location.. Federated identity with single sign-on (SSO) allows users to authenticate once and access multiple SaaS applications, while conditional access policies evaluate device posture (e.g., compliance status, managed vs. unmanaged) and network location (e.g., corporate IP range vs. external) to enforce MFA only when risk conditions are met. This architecture leverages standards like SAML 2.0 or OpenID Connect for SSO and integrates with device management systems (e.g., MDM) to assess device health before granting access.

Answer

Create separate usernames and passwords for each SaaS application and disable browser-based token sharing.

Answer

Use local accounts in each SaaS application and rotate passwords every 30 days.

Answer

Grant all employees the same access role to simplify authentication and reduce support tickets.

Question 11

A small company is moving its public web app to a new network. The front-end server must be reachable from the internet, the application server should only accept traffic from the front end, and the database must never be reachable from the internet or user VLANs. Which design best meets these requirements with the least exposure?

Accepted Answer

Place the web server in a DMZ, the application server in an internal subnet, and the database in a separate restricted subnet with firewall rules between each tier.. It implements a classic three-tier architecture with network segmentation. The web server in the DMZ is isolated from internal networks but accessible from the internet, the application server in an internal subnet is protected by firewall rules that only allow traffic from the DMZ, and the database in a separate restricted subnet is further isolated with firewall rules that only permit traffic from the application server. This design minimizes exposure by enforcing least privilege and defense in depth, using network-layer segmentation rather than relying solely on host-based controls.

Answer

Place all three servers in the same server VLAN and use host-based firewalls to separate them.

Answer

Place the database in the DMZ so the web and application servers can access it directly without extra firewall rules.

Answer

Place the web server on the user VLAN and use NAT to hide the database server from the internet.

Question 12

After a merger, dozens of laptops arrive with inconsistent settings and a history of unsupported utilities installed by the previous owner. The security team wants to establish a known-good configuration, reduce future drift, and accelerate remediation of newly discovered vulnerabilities. Which three actions best support that goal? Select three.

Accepted Answer

Build and deploy a secure baseline or gold image for the laptops.. A is correct because building and deploying a secure baseline or gold image ensures all laptops start from a known-good configuration, eliminating inconsistencies and unsupported utilities from the previous owner. This directly supports the goal of establishing a trusted state and provides a reference point for detecting future drift.

Answer

Allow each user to customize local security settings for productivity.

Answer

Skip validation after patching because the baseline will always remain correct.

Question 13

An office wants finance workstations separated from general user PCs, but employees still need to print to a shared printer and access one accounting application. Which change best supports this?

Accepted Answer

Move finance systems to a separate VLAN or subnet and allow only required traffic through filtering rules.. Placing finance systems on a separate VLAN or subnet with a Layer 3 boundary enforces network segmentation, which limits broadcast domains and restricts lateral movement. By configuring access control lists (ACLs) or firewall rules to permit only the required traffic (e.g., SMB/CIFS for printer sharing and specific TCP/UDP ports for the accounting application), the organization achieves a least-privilege network architecture. This approach aligns with the principle of defense-in-depth, reducing the attack surface while maintaining necessary business functionality.

Answer

Place all systems on one VLAN and rely on strong passwords.

Answer

Put the printer in a different building to make it more secure.

Answer

Enable screen lock timers on the finance PCs and keep the network flat.

Question 14

Several company laptops were found to boot from a removable drive containing an untrusted pre-boot utility before the operating system loaded. The security team wants to prevent unsigned or tampered boot code from starting. Which control is the best fit?

Accepted Answer

Enable Secure Boot in firmware and block external boot devices where possible.. Secure Boot is a UEFI firmware feature that verifies the digital signature of boot code against a trusted database before execution. By enabling Secure Boot and blocking external boot devices, the security team ensures that only signed, trusted bootloaders and drivers can run, preventing untrusted pre-boot utilities from loading. This directly addresses the scenario where laptops boot from a removable drive containing unsigned or tampered boot code.

Answer

Turn on screen lock after ten minutes of inactivity.

Answer

Increase the password complexity policy for user accounts.

Answer

Disable Windows Defender notifications on the endpoints.

Question 15

A manager can access the HR portal normally from a managed laptop, but if they sign in from an unmanaged tablet, the system should require extra verification before granting access. Which control best fits?

Accepted Answer

Conditional access based on device trust or risk.. Conditional access policies evaluate device trust (e.g., compliance with security baselines, domain membership) and risk signals (e.g., location, sign-in behavior) to enforce step-up authentication. This directly matches the requirement: allow normal access from a managed laptop, but require extra verification from an unmanaged tablet. Other options like password expiration, VLAN segmentation, or encryption do not dynamically adjust authentication requirements based on device trust.

Answer

A longer password expiration interval.

Answer

A separate VLAN for each manager.

Answer

Data encryption at rest on the HR database.