20+ practice questions focused on Security Architecture — one of the most tested topics on the Security+ SY0-701 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Security Architecture PracticeA security architect is redesigning remote administration for a set of critical Linux servers in a private cloud. Currently, system administrators connect directly from their corporate laptops to the servers over the internet using SSH. The architect's primary goal is to eliminate direct inbound SSH connections from the internet while still allowing authorized administrators to perform maintenance tasks. Which of the following architectural changes would best achieve this objective?
Explanation: Option B is the best because it eliminates direct inbound SSH from the internet by placing a jump server (bastion host) in a management subnet that is only accessible via the corporate VPN. Administrators must first connect to the VPN, then SSH to the jump server, and from there initiate SSH sessions to the target Linux servers. This architecture ensures no SSH port is exposed to the public internet and provides a centralized control/audit point. While a VPN alone (Option A) could also remove direct internet exposure if the servers are placed behind the VPN, it does not provide the same level of administrative control and monitoring as a dedicated jump server.
A security architect is designing a solution to securely store sensitive customer data in a cloud object storage service. The architect's primary concern is that if the storage bucket is accidentally configured as publicly accessible, the data should still be protected from unauthorized viewing. Which of the following architectural designs provides the strongest defense in depth to meet this concern?
Explanation: Client-side encryption ensures data is encrypted before it leaves the client device, so even if the object storage bucket is inadvertently made publicly accessible, the stored ciphertext remains unreadable without the customer-managed encryption key held in the HSM. This provides defense in depth by combining application-layer encryption with access control restrictions at the cloud provider's management layer. Server-side encryption alone only protects data at rest on the provider's infrastructure and does not prevent an unauthorized user from accessing the decrypted data if the storage access policy is misconfigured to allow public read access.
A manufacturing company is redesigning its plant network. PLCs must communicate with a SCADA server for telemetry, but neither the PLCs nor the SCADA server should be reachable from employee laptops or the internet. Which architecture best meets the requirement?
Explanation: It creates an isolated OT (Operational Technology) zone using a firewall, which enforces segmentation between the industrial control systems (PLCs and SCADA) and the corporate IT network. By placing the SCADA server and PLCs behind a firewall with explicit allow rules only for necessary PLC-to-SCADA telemetry, the architecture ensures that employee laptops and the internet cannot reach these devices, meeting the requirement for no reachability from those sources.
A manufacturer wants partner-company users to access a procurement portal using their own company identities. The manufacturer does not want to create local accounts for each partner user, but it still needs to control what those users can do in the portal. Which approach should be used?
Explanation: Federated identity with role mapping allows the manufacturer to trust authentication performed by each partner's own identity provider (IdP) using standards like SAML 2.0 or OpenID Connect. This eliminates the need for local accounts while enabling fine-grained access control through roles or attributes passed in the assertion, ensuring partners can only perform authorized actions in the portal.
A manufacturer wants partner-company users to access a procurement portal. The manufacturer does not want to create separate local accounts, and the partners want to authenticate their own users with existing corporate identities. Which two capabilities should be implemented? Select two.
Explanation: Federation allows the manufacturer to trust identity assertions from the partners' own identity providers (IdPs) using standards like SAML 2.0 or OIDC. This eliminates the need for local accounts while enabling partners to authenticate with their existing corporate identities. However, authentication alone does not determine what users are allowed to do; after successful federation, the application must map partner roles or groups to application permissions. Both federation (authentication) and role mapping (authorization) are required to meet the full access control needs.
+15 more Security Architecture questions available
Practice all Security Architecture questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Security Architecture. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Security Architecture questions on the SY0-701 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Security Architecture is tested as part of the Security+ SY0-701 blueprint. Practicing with targeted Security Architecture questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free SY0-701 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Security Architecture is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Security Architecture practice session with instant scoring and detailed explanations.
Start Security Architecture Practice →