SY0-701 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Perform a full-device wipe any time a tablet is lost or reassigned.

  Why it's wrong here

  A full-device wipe is a reactive, all-or-nothing control that only triggers after loss or reassignment, and it cannot separate or protect corporate data during day-to-day use. It also destroys personal data on the device, and if the device is lost without network connectivity, the wipe may never execute. It does not establish a boundary between work and personal content, so it fails to address the underlying need for ongoing containerization.

• ✗

  Deploy mobile threat defense scanning on every tablet.

  Why it's wrong here

  Mobile threat defense (MTD) scans for malware, malicious network traffic, and risky apps, but it is a detection-oriented control that does not isolate corporate data from personal apps or storage. An MTD solution cannot prevent data leakage through legitimate but unmanaged personal apps, nor can it selectively wipe only the corporate partition. Without a work profile or container, the corporate data remains accessible to all device apps, so MTD alone does not solve the separation requirement.

• ✓

  Enable a work profile or container with selective wipe for corporate data.

  Why this is correct

  Enabling a work profile (e.g., Android Work Profile or iOS managed container) creates a dedicated, encrypted boundary that separates corporate apps and data from personal content on the same device. Policies can enforce selective wipe of only that container when a device is lost, reassigned, or non-compliant, preserving the user's personal data. This also allows IT to manage corporate email, VPN, and app restrictions within the profile without granting full control of the personal side—directly addressing the need for workflow separation.

• ✗

  Disable Bluetooth and the camera on all tablets to stop data leakage.

  Why it's wrong here

  Disabling Bluetooth and camera restricts specific exfiltration channels, but it does not create a logical separation between corporate and personal data, nor does it prevent data leakage through email, cloud storage, or USB. It is a blunt policy that hampers usability and still leaves corporate data co-mingled with personal apps, so the core problem of managing corporate data on a shared device remains. Selective wipe and containerization are the only options that provide a distinct, manageable corporate data boundary.