SY0-701 Security Architecture Practice Question
After a merger, dozens of laptops arrive with inconsistent settings and a history of unsupported utilities installed by the previous owner. The security team wants to establish a known-good configuration, reduce future drift, and accelerate remediation of newly discovered vulnerabilities. Which three actions best support that goal? Select three.
⚠ Common exam trap
A common mix-up: candidates think user customization (Option D) is acceptable for productivity, but the scenario explicitly requires a known-good configuration and reduced drift, making any uncontrolled customization counterproductive.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Build and deploy a secure baseline or gold image for the laptops.
A is correct because building and deploying a secure baseline or gold image ensures all laptops start from a known-good configuration, eliminating inconsistencies and unsupported utilities from the previous owner. This directly supports the goal of establishing a trusted state and provides a reference point for detecting future drift.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Build and deploy a secure baseline or gold image for the laptops.
Why this is correct
A secure baseline establishes the approved configuration for the fleet and gives the team a repeatable starting point. A gold image reduces configuration variation from device to device and makes it easier to verify what should be present. It is the most direct way to normalize inherited systems after a merger or acquisition.
- ✓
Use centralized patch management with staged rollouts and reporting.
Why this is correct
Centralized patch management lets the team deploy fixes consistently, track success, and react quickly to newly discovered vulnerabilities. Staged rollout reduces business disruption by testing updates on a smaller group before broad deployment. This approach balances speed, stability, and visibility, which is ideal for a mixed and inherited laptop population.
- ✓
Enforce configuration management that reapplies approved settings after drift is detected.
Why this is correct
Configuration management tools can continually compare devices against the approved state and correct unauthorized changes. That reduces long-term drift caused by users, contractors, or inherited local settings. It is especially valuable when the organization wants a known-good posture instead of one-time setup only.
- ✗
Allow each user to customize local security settings for productivity.
Why it's wrong here
User-driven customization increases inconsistency and makes it harder to prove that devices are secure. Local changes may weaken controls, create exceptions, or interfere with patching and support. The scenario is asking for standardization and drift reduction, not personalization.
- ✗
Skip validation after patching because the baseline will always remain correct.
Why it's wrong here
Assuming patching always succeeds without verification creates blind spots and delays detection of failed updates. Validation is necessary because systems can miss patches, reboot unexpectedly, or diverge from the intended configuration. The organization needs monitoring and reporting, not blind trust in deployment.
Go deeper
Related to this question
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.