SY0-701 Security Architecture Practice Test 9 — 15 Questions

Question 1

Match each cloud security concept to the best description.

Accepted Answer

Encryption: Protects data by converting it into a secure format.. Each cloud security concept is matched to its primary function: encryption protects data at rest or in transit, IAM manages access, SIEM provides event analysis, IDS detects intrusions, and DLP prevents data loss.

Answer

Encryption: Manages user access to resources.

Answer

IAM: Protects data by encoding it.

Question 2

Match each network segment to the best use in a small enterprise.

Accepted Answer

Guest Wi-Fi: Used for external users to access the internet without accessing internal resources.. Each segment serves a specific purpose: guest Wi-Fi for external users, DMZ for public services, internal LAN for daily operations, management for device control, data center for core infrastructure, VPN for secure remote access.

Answer

VPN: Used for managing network devices (switches, routers).

Answer

Management: Provides secure remote access to internal network for employees.

Question 3

A branch office has users, finance workstations, and printers on the same LAN. Management wants finance devices isolated from general users while still allowing approved printing and internet access. Which two changes best meet this goal? Select two.

Accepted Answer

Put finance systems in a separate VLAN.. Placing finance systems in a separate VLAN (Option A) segments the LAN into isolated broadcast domains, preventing general users from directly accessing finance workstations at Layer 2. This is a foundational step for network segmentation, as VLANs logically separate traffic without requiring physical re-cabling.

Answer

Remove the default gateway from all finance devices.

Answer

Place all systems in one flat subnet.

Answer

Use hubs instead of switches to simplify traffic flow.

Question 4

A branch office has users, finance workstations, printers, and IP phones on one flat network. The security team wants to reduce lateral movement if one user PC is compromised, but printers still need to receive print jobs from users. What is the best design change?

Accepted Answer

Place finance systems and user devices in separate VLANs and allow only the necessary print and business application traffic through filtering rules.. Segmenting the flat network into separate VLANs for finance systems and user devices enforces network segmentation, which limits lateral movement. By using VLANs and firewall rules to allow only necessary traffic (e.g., print jobs via IPP or SMB, and business application traffic), the organization reduces the attack surface while maintaining required functionality. This aligns with the principle of least privilege and zero trust architecture.

Answer

Keep one flat network and increase endpoint antivirus scanning frequency.

Answer

Move all printers into the finance VLAN to avoid managing inter-VLAN rules.

Answer

Disable printing so user workstations cannot communicate with any other device.

Question 5

Based on the exhibit, which cloud deployment choice best satisfies the workload requirements?

Exhibit:
Workload requirements:
- Processes regulated customer records
- Should not share underlying compute with other tenants if avoidable
- Team wants provider-managed hardware maintenance
- Application will run in a public cloud

Which deployment choice is the best fit?

Accepted Answer

Public cloud with a dedicated host or equivalent single-tenant compute placement.. A dedicated host or single-tenant compute placement in a public cloud ensures the workload does not share underlying physical hardware with other tenants, meeting the 'should not share underlying compute' requirement. It also provides provider-managed hardware maintenance and runs in a public cloud, aligning with all stated workload requirements for processing regulated customer records.

Answer

Shared public tenancy on standard virtual machines.

Answer

Community cloud shared with other regulated organizations.

Answer

On-premises private cloud with company-owned servers and full hardware management.

Question 6

A company wants visibility into who changed settings in its cloud account and what commands ran on a cloud VM. Which two log sources should the team enable first? Select two.

Accepted Answer

Cloud provider audit or API logs. Cloud provider audit or API logs (Option A) capture all changes made to the cloud account via the provider's management plane, including who modified settings and when. Guest operating system event logs (Option B) record commands executed within the VM itself, such as PowerShell or bash commands, providing visibility into runtime activities. Together, these two sources cover both the control plane (account-level changes) and data plane (VM-level commands) for comprehensive monitoring.

Answer

Printer spooler logs

Answer

Browser history from employees' home PCs

Answer

DHCP lease logs from the office router

Question 7

A company wants employees to sign in once to access several SaaS applications, but it also wants to require MFA only when users connect from unmanaged devices or outside the corporate network. Which architecture best supports this goal?

Accepted Answer

Implement federated identity with single sign-on and conditional access policies tied to device posture and network location.. Federated identity with single sign-on (SSO) allows users to authenticate once and access multiple SaaS applications, while conditional access policies evaluate device posture (e.g., compliance status, managed vs. unmanaged) and network location (e.g., corporate IP range vs. external) to enforce MFA only when risk conditions are met. This architecture leverages standards like SAML 2.0 or OpenID Connect for SSO and integrates with device management systems (e.g., MDM) to assess device health before granting access.

Answer

Create separate usernames and passwords for each SaaS application and disable browser-based token sharing.

Answer

Use local accounts in each SaaS application and rotate passwords every 30 days.

Answer

Grant all employees the same access role to simplify authentication and reduce support tickets.

Question 8

A small company is moving its public web app to a new network. The front-end server must be reachable from the internet, the application server should only accept traffic from the front end, and the database must never be reachable from the internet or user VLANs. Which design best meets these requirements with the least exposure?

Accepted Answer

Place the web server in a DMZ, the application server in an internal subnet, and the database in a separate restricted subnet with firewall rules between each tier.. It implements a classic three-tier architecture with network segmentation. The web server in the DMZ is isolated from internal networks but accessible from the internet, the application server in an internal subnet is protected by firewall rules that only allow traffic from the DMZ, and the database in a separate restricted subnet is further isolated with firewall rules that only permit traffic from the application server. This design minimizes exposure by enforcing least privilege and defense in depth, using network-layer segmentation rather than relying solely on host-based controls.

Answer

Place all three servers in the same server VLAN and use host-based firewalls to separate them.

Answer

Place the database in the DMZ so the web and application servers can access it directly without extra firewall rules.

Answer

Place the web server on the user VLAN and use NAT to hide the database server from the internet.

Question 9

After a merger, dozens of laptops arrive with inconsistent settings and a history of unsupported utilities installed by the previous owner. The security team wants to establish a known-good configuration, reduce future drift, and accelerate remediation of newly discovered vulnerabilities. Which three actions best support that goal? Select three.

Accepted Answer

Build and deploy a secure baseline or gold image for the laptops.. A is correct because building and deploying a secure baseline or gold image ensures all laptops start from a known-good configuration, eliminating inconsistencies and unsupported utilities from the previous owner. This directly supports the goal of establishing a trusted state and provides a reference point for detecting future drift.

Answer

Allow each user to customize local security settings for productivity.

Answer

Skip validation after patching because the baseline will always remain correct.

Question 10

An office wants finance workstations separated from general user PCs, but employees still need to print to a shared printer and access one accounting application. Which change best supports this?

Accepted Answer

Move finance systems to a separate VLAN or subnet and allow only required traffic through filtering rules.. Placing finance systems on a separate VLAN or subnet with a Layer 3 boundary enforces network segmentation, which limits broadcast domains and restricts lateral movement. By configuring access control lists (ACLs) or firewall rules to permit only the required traffic (e.g., SMB/CIFS for printer sharing and specific TCP/UDP ports for the accounting application), the organization achieves a least-privilege network architecture. This approach aligns with the principle of defense-in-depth, reducing the attack surface while maintaining necessary business functionality.

Answer

Place all systems on one VLAN and rely on strong passwords.

Answer

Put the printer in a different building to make it more secure.

Answer

Enable screen lock timers on the finance PCs and keep the network flat.

Question 11

Several company laptops were found to boot from a removable drive containing an untrusted pre-boot utility before the operating system loaded. The security team wants to prevent unsigned or tampered boot code from starting. Which control is the best fit?

Accepted Answer

Enable Secure Boot in firmware and block external boot devices where possible.. Secure Boot is a UEFI firmware feature that verifies the digital signature of boot code against a trusted database before execution. By enabling Secure Boot and blocking external boot devices, the security team ensures that only signed, trusted bootloaders and drivers can run, preventing untrusted pre-boot utilities from loading. This directly addresses the scenario where laptops boot from a removable drive containing unsigned or tampered boot code.

Answer

Turn on screen lock after ten minutes of inactivity.

Answer

Increase the password complexity policy for user accounts.

Answer

Disable Windows Defender notifications on the endpoints.

Question 12

A manager can access the HR portal normally from a managed laptop, but if they sign in from an unmanaged tablet, the system should require extra verification before granting access. Which control best fits?

Accepted Answer

Conditional access based on device trust or risk.. Conditional access policies evaluate device trust (e.g., compliance with security baselines, domain membership) and risk signals (e.g., location, sign-in behavior) to enforce step-up authentication. This directly matches the requirement: allow normal access from a managed laptop, but require extra verification from an unmanaged tablet. Other options like password expiration, VLAN segmentation, or encryption do not dynamically adjust authentication requirements based on device trust.

Answer

A longer password expiration interval.

Answer

A separate VLAN for each manager.

Answer

Data encryption at rest on the HR database.

Question 13

An organization is redesigning access for its HR portal. HR staff need to update employee records, managers need to approve leave requests, and payroll staff need access to salary data, but no single user should receive all of those permissions by default. What is the best access model?

Accepted Answer

Create separate roles for HR, managers, and payroll, and grant only the permissions needed for each job function.. Role-Based Access Control (RBAC) assigns permissions based on job functions, ensuring that HR staff, managers, and payroll personnel receive only the privileges necessary for their roles. This enforces the principle of least privilege and prevents any single user from inheriting all permissions by default, which aligns with the organization's security requirement.

Answer

Assign everyone the same portal permissions to simplify administration.

Answer

Give every manager full HR and payroll access so approvals are faster.

Answer

Use one shared administrator account for all HR actions to keep audits simple.

Question 14

A small company is publishing an internal website to the internet. The security team wants the web server reachable from the internet while keeping the database and file share isolated from direct internet access. Which design is best?

Accepted Answer

Place the web server in a DMZ and keep the database and file share on a private internal subnet.. It implements a DMZ architecture where the web server is placed in a publicly accessible network segment, while the database and file share reside on a private internal subnet. This design ensures that even if the web server is compromised, an attacker cannot directly access the internal resources because firewall rules restrict inbound traffic to only the DMZ and block any initiated connections from the DMZ to the internal network. This follows the principle of defense in depth and network segmentation as recommended by CompTIA for securing multi-tier applications.

Answer

Place the web server and database on the same flat internal network behind the firewall.

Answer

Place the database in the DMZ and keep the web server on the internal user VLAN.

Answer

Use a VPN for all users and keep every server on the same subnet.

Question 15

A company wants to stop employees from running unauthorized tools downloaded from the internet on managed Windows laptops, but still allow approved internal apps and vendor-updated software. Which control is best?

Accepted Answer

Application control using an allowlist for approved executables and publishers.. Application control with an allowlist (also known as whitelisting) is the correct choice because it explicitly defines which executables, scripts, and publishers are permitted to run on managed Windows laptops. This prevents unauthorized tools downloaded from the internet from executing, while allowing approved internal apps and vendor-updated software that match the allowlist criteria. Technologies like Windows Defender Application Control (WDAC) or AppLocker enforce this by checking file hashes, publisher signatures, or path rules at runtime.

Answer

Full-disk encryption on every laptop before deployment.

Answer

A stronger screen-lock timeout and automatic logoff policy.

Answer

A firmware password for the BIOS without any other endpoint restrictions.