Courseiva

CCNA Security Architecture Questions

75 of 182 questions · Page 1/3 · Security Architecture · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

Based on the exhibit, which change best reduces the blast radius if a user workstation is compromised?

A.Add more allow rules from VLAN 10 to VLAN 30 for SMB and RDP so restore jobs stay flexible.
B.Move the backup server into the user VLAN to avoid routing and ACL complexity.
C.Remove direct user access to the backup VLAN and allow only the dedicated backup path.
D.Increase the DHCP lease time so backup jobs run less often during business hours.
AnswerC

Eliminating direct user access to the backup VLAN is a textbook application of network segmentation and the principle of least privilege. By restricting communication to only the dedicated backup application path—for example, a backup server or agent initiating outbound connections to storage on specific ports—a compromised workstation cannot reach recovery repositories laterally. This containment shrinks the blast radius, ensuring that even if an endpoint is fully controlled by an attacker, the confidentiality, integrity, and availability of backups remain intact, which is essential for incident recovery and ransomware mitigation.

Why this answer

Removing direct user access to the backup VLAN and allowing only the dedicated backup path enforces network segmentation, which limits lateral movement. If a workstation in VLAN 10 is compromised, an attacker cannot pivot directly to the backup server in VLAN 30, reducing the blast radius. This aligns with the principle of least privilege and defense-in-depth for backup infrastructure.

Exam trap

The trap here is that candidates may think adding more allow rules (Option A) improves flexibility, but in security architecture, reducing unnecessary access paths is key to minimizing blast radius, not increasing connectivity.

How to eliminate wrong answers

Option A is wrong because adding more allow rules from VLAN 10 to VLAN 30 for SMB and RDP increases the attack surface, allowing a compromised workstation to directly access backup servers, which expands rather than reduces the blast radius. Option B is wrong because moving the backup server into the user VLAN eliminates network segmentation entirely, exposing the backup server to any compromised workstation in the same broadcast domain and defeating the purpose of isolation. Option D is wrong because increasing the DHCP lease time does not affect network access controls or segmentation; it only delays IP address renewal and has no impact on blast radius reduction.

Practice this question →
2
MCQmedium

A company is redesigning its network to host a public-facing web application that accesses a confidential database. The security team needs to minimize the risk of a direct attack against the database server while still allowing the web server to retrieve and update data. Which network architecture best achieves this objective?

A.Place both the web server and the database server in the same DMZ segment and rely on host-based firewalls for protection.
B.Place the web server in the DMZ and the database server on the internal network. Configure the firewall to allow inbound traffic from the web server to the database server on the required port only.
C.Connect both servers to a single internal VLAN and use a reverse proxy to forward external traffic to the web server.
D.Use a site-to-site VPN to connect the web server and database server, and place both behind a single NAT gateway.
AnswerB

This architecture follows the principle of defense in depth. The DMZ provides an additional security layer for the web server, while the database is isolated on the internal network with a restrictive firewall rule that limits access to only the web server, reducing the attack surface.

Why this answer

It implements a tiered network architecture where the web server resides in the DMZ (a semi-trusted zone) and the database server is placed on the internal network, isolated from direct internet access. The firewall is configured with a stateful rule that permits only the web server's IP and the specific database port (e.g., TCP 3306 for MySQL or 1433 for MSSQL), preventing any direct inbound connections from the internet to the database. This minimizes the attack surface by ensuring that even if the web server is compromised, the database is not directly reachable from external hosts.

Exam trap

The trap here is that candidates often assume placing both servers in the DMZ is sufficient because they think the DMZ itself provides isolation, but they overlook that the DMZ is still a single security zone where lateral movement between hosts is not restricted, making the database vulnerable if the web server is breached.

Why the other options are wrong

A

Placing both servers in the same DMZ segment exposes the database to the same untrusted network as the web server, increasing the attack surface. Host-based firewalls alone are insufficient to prevent a direct attack on the database if the web server is compromised.

C

Placing both servers on a single internal VLAN with a reverse proxy does not isolate the database from direct external access; if the web server is compromised, the attacker can pivot directly to the database on the same VLAN, violating the principle of defense in depth.

D

A site-to-site VPN connects two networks securely, but placing both servers behind a single NAT gateway does not isolate the database from direct internet exposure, failing to minimize the risk of direct attack against the database server.

Practice this question →
3
MCQmedium

After a server rebuild, an administrator notices that Remote Desktop, SMBv1, and Print Spooler are still enabled on a Windows file server even though the server only stores department documents. The security team also wants to know if future changes drift away from the approved build. What should be implemented?

A.Apply the approved secure baseline and enable configuration drift monitoring against it.
B.Keep the server as-is and rely on the antivirus console to stop misuse.
C.Move the server into a different VLAN and leave the operating system settings unchanged.
D.Schedule a monthly reboot to clear temporary settings and reduce attack surface.
AnswerA

A secure baseline defines the expected hardened state, and drift monitoring detects unauthorized or accidental changes over time. This directly addresses both the current unnecessary services and the need to catch future deviations. It is the most complete and operationally useful response.

Why this answer

Applying an approved secure baseline (e.g., via Group Policy or Security Compliance Toolkit) ensures that unnecessary services like Remote Desktop, SMBv1, and Print Spooler are explicitly disabled. Enabling configuration drift monitoring (e.g., using Azure Policy, DSC, or a SIEM) allows the security team to detect and alert on any unauthorized changes that deviate from the baseline, addressing both the immediate risk and the long-term compliance requirement.

Exam trap

The trap here is that candidates often think network segmentation (VLAN) or periodic reboots are sufficient to mitigate service-level vulnerabilities, but the question specifically asks for a solution that prevents future drift from an approved build, which requires a baseline and monitoring, not just isolation or temporary fixes.

How to eliminate wrong answers

Option B is wrong because relying solely on an antivirus console does not disable or prevent the exploitation of enabled services like SMBv1 (which is vulnerable to EternalBlue) or Print Spooler (which has known privilege escalation flaws); antivirus is not a substitute for reducing the attack surface. Option C is wrong because moving the server to a different VLAN does not disable the enabled services; it only segments network traffic, leaving the server still vulnerable to lateral movement if an attacker gains access to that VLAN. Option D is wrong because scheduling a monthly reboot does not permanently disable services or prevent drift; it only clears temporary settings, and the unwanted services would remain enabled after each reboot.

Practice this question →
4
MCQeasy

After building a new file server, an administrator reviews the security baseline and notices that a remote desktop service is enabled even though no one uses it. What is the best hardening action?

A.Keep the service enabled in case someone needs it later
B.Disable the unnecessary service
C.Change the server name to make it harder to find
D.Increase disk space on the server
AnswerB

Removing unused services reduces attack surface and aligns the server with the secure baseline.

Why this answer

The best hardening action is to disable the unnecessary remote desktop service because it reduces the attack surface. An enabled but unused service, such as Remote Desktop Protocol (RDP) on TCP/3389, is a common vector for brute-force attacks and exploits (e.g., BlueKeep, CVE-2019-0708). Disabling it eliminates this risk without affecting legitimate operations.

Exam trap

The trap here is that candidates may confuse 'security through obscurity' (e.g., renaming the server) with a proper hardening action, or they may assume that keeping a service enabled 'just in case' is acceptable, when the correct approach is to disable any unnecessary service to minimize the attack surface.

How to eliminate wrong answers

Option A is wrong because keeping an unused service enabled violates the principle of least functionality and needlessly exposes the server to potential exploitation. Option C is wrong because changing the server name does not mitigate the risk of the service being discovered or attacked; RDP can still be scanned and targeted regardless of the hostname. Option D is wrong because increasing disk space does not address the security risk of an unnecessary service; it is a resource management action, not a hardening measure.

Practice this question →
5
Multi-Selecteasy

A help desk team needs to reset passwords on servers during incidents, but they should not keep standing administrator rights all day. Which two controls best support this requirement? Select two.

Select 2 answers
A.Use privileged access management (PAM) to control and audit elevated access.
B.Grant time-limited or just-in-time elevation only when the task is approved.
C.Share one permanent domain administrator account with the whole team.
D.Use a regular user account and disable all authentication logging.
E.Give every help desk user full access all the time so work is faster.
AnswersA, B

PAM is a security framework that centralizes management of privileged accounts, including secure credential storage, automated password rotation, and session recording. It enforces a controlled workflow where help desk staff check out elevated credentials only for approved tasks, and every action is logged and attributable to an individual. This transforms ad-hoc privileged access into an auditable, approval-based process, directly supporting least privilege and compliance.

Why this answer

Privileged Access Management (PAM) solutions enforce just-in-time (JIT) elevation, time-bound access, and session auditing. This allows the help desk team to obtain administrator rights only when needed for incident response, eliminating the need for standing admin rights while maintaining full audit trails.

Exam trap

The trap here is that candidates may think sharing a single domain admin account is efficient for a team, but CompTIA tests that this violates auditability and the principle of least privilege, making it the opposite of what the scenario requires.

Practice this question →
6
MCQmedium

Based on the exhibit, which change should be made first to secure remote administration of the network device?

A.Enable FTP so administrators can upload and download configuration files securely.
B.Disable Telnet and allow SSHv2 only for remote administration.
C.Open the management interface to any internet host as long as the password is complex.
D.Use one shared local administrator account for all network engineers.
AnswerB

Telnet sends all management traffic, including login credentials and command output, as unencrypted text over TCP port 23, making it trivial for an attacker on the network path to intercept the session and obtain privileged access. SSHv2, by contrast, provides confidentiality, integrity, and server authentication via cryptographic key exchange, and it can enforce strong cipher and MAC algorithms for the management session. Disabling Telnet and enabling only SSHv2 for remote administration is the correct first hardening step for the management plane.

Why this answer

Telnet transmits all data, including credentials, in cleartext, making it vulnerable to interception. SSHv2 provides encrypted remote administration and is the secure replacement for Telnet. Disabling Telnet and enabling only SSHv2 is the immediate and necessary first step to secure remote device management.

Exam trap

The trap here is that candidates may think enabling a protocol like FTP with 'secure' in its name is sufficient, or they may overlook that Telnet's lack of encryption is the most critical vulnerability to address first, not password complexity or shared accounts.

How to eliminate wrong answers

Option A is wrong because FTP also transmits credentials and data in cleartext; it is not a secure protocol and should not be used for remote administration. Option C is wrong because exposing the management interface to any internet host dramatically increases the attack surface, regardless of password complexity; management should be restricted to trusted IPs or a jump host. Option D is wrong because using a shared local administrator account eliminates accountability and audit trails; each administrator should have unique credentials for non-repudiation and proper logging.

Practice this question →
7
Multi-Selecteasy

Employees need to sign in once to the corporate portal and then access email and the HR app without entering credentials again. Which two technologies make this possible in a secure design? Select two.

Select 2 answers
A.Single sign-on (SSO).
B.Federation between the identity provider and the other applications.
C.Network address translation (NAT).
D.Port address translation (PAT).
E.A hardened BIOS password on each workstation.
AnswersA, B

Single sign-on (SSO) is the correct mechanism because it permits a user to authenticate once to a central identity provider and then access multiple trusted applications without being prompted for credentials again. The authentication produces a session or token that is presented to each service, enabling seamless navigation through the corporate portal. This reduces password fatigue, centralizes identity governance, and allows administrators to enforce consistent authentication policies across all connected applications.

Why this answer

Single sign-on (SSO) allows a user to authenticate once and then access multiple applications (email, HR app) without re-entering credentials. This is achieved by the identity provider (IdP) issuing a token (e.g., SAML assertion, OIDC ID token) that is trusted by the service providers. SSO reduces password fatigue and centralizes authentication, but must be paired with federation to securely share identity across different domains or applications.

Exam trap

CompTIA often tests the distinction between SSO and federation, where candidates mistakenly think SSO alone is sufficient for cross-domain access, but federation is required when the applications are managed by different identity domains or external providers.

Practice this question →
8
MCQmedium

Administrators need to manage internal switches from home. Management traffic must be encrypted, MFA must be used, and no switch management interface should be exposed directly to the internet. Which design is best?

A.Open SSH directly to each switch on a public IP address and restrict access by source IP only.
B.Use a VPN into the internal network, then administer the switches through a hardened jump host over SSH.
C.Allow HTTPS management to each switch over the internet because the channel is encrypted.
D.Use Telnet inside the office and route home users through a split-tunnel VPN.
AnswerB

This design keeps management interfaces internal, encrypts traffic over the VPN, and lets the organization enforce MFA at the VPN or jump-host entry point. SSH provides secure device administration while the jump host centralizes access and logging.

Why this answer

It uses a VPN to create an encrypted tunnel from the home user to the internal network, then requires SSH (which encrypts management traffic) through a hardened jump host. This design ensures MFA can be enforced at the VPN or jump host layer, and no switch management interface is directly exposed to the internet, satisfying all three requirements.

Exam trap

The trap here is that candidates often think HTTPS encryption alone is sufficient for internet-exposed management, ignoring the requirement that no management interface be directly exposed to the internet, and that MFA must be enforced separately.

How to eliminate wrong answers

Option A is wrong because opening SSH directly to each switch on a public IP address exposes the management interface to the internet, violating the requirement that no switch interface be directly exposed; source IP restriction alone is insufficient as a security control and does not enforce MFA. Option C is wrong because allowing HTTPS management directly over the internet still exposes the switch management interface to the internet, and while HTTPS encrypts the channel, it does not inherently enforce MFA or prevent direct exposure. Option D is wrong because Telnet transmits data in cleartext (no encryption), and a split-tunnel VPN would route home users through the internet for management traffic, failing to encrypt the management session and exposing the traffic.

Practice this question →
9
MCQeasy

A team manages virtual machines in a public cloud and wants an audit trail of who created instances, changed security groups, and modified IAM settings. What should be enabled first?

A.Host-based antivirus on each virtual machine.
B.Cloud control plane or audit logging.
C.A guest operating system screen saver policy.
D.A static public IP address for every virtual machine.
AnswerB

This is the best answer because audit logs record management actions such as instance creation, security group changes, and IAM updates. Those events are central to cloud investigations and change tracking. Enabling cloud-native logging first gives the team visibility into who did what and when, which is essential for security monitoring and accountability.

Why this answer

Cloud control plane or audit logging (e.g., AWS CloudTrail, Azure Monitor, or Google Cloud Audit Logs) captures all API calls that create instances, modify security groups, or change IAM settings. This provides the required audit trail of who performed each action, when, and from what source, which is essential for security incident response and compliance.

Exam trap

The trap here is confusing guest OS-level controls (antivirus, screen saver) with cloud provider-level audit logging, leading candidates to pick a security tool that addresses a different threat surface.

How to eliminate wrong answers

Option A is wrong because host-based antivirus protects against malware on the VM's operating system but does not log cloud control plane actions like instance creation or IAM changes. Option C is wrong because a guest OS screen saver policy enforces local session locking, which is unrelated to auditing cloud-level administrative actions. Option D is wrong because assigning a static public IP to each VM provides a fixed network address but generates no audit logs for who created instances or modified security groups.

Practice this question →
10
Multi-Selectmedium

Field staff use company-owned tablets that also run approved personal apps. Security needs business data isolated from personal data, the ability to wipe only corporate content, and enforcement of screen lock and encryption. Which two controls best fit? Select two.

Select 2 answers
A.Enroll the tablets in MDM and enforce encryption and a screen-lock PIN.
B.Use a managed work profile or container to separate corporate apps and data.
C.Allow rooted devices if the antivirus app is current.
D.Place all apps in one shared profile and use a single passcode for every user.
E.Disable remote wipe so personal photos are never affected.
AnswersA, B

Enrolling tablets in Mobile Device Management (MDM) directly addresses the need for isolating business data from personal data through containerisation or separate profiles. This mechanism also enables the crucial ability to selectively wipe only corporate content, leaving personal data untouched. Furthermore, MDM provides the capability to enforce essential security policies such as device encryption and a screen-lock PIN, satisfying all specified requirements for data protection and access control on mixed-use company devices.

Why this answer

Mobile Device Management (MDM) enforces security policies like encryption and screen-lock PIN across the device, meeting the requirements for data protection. Option B is correct because a managed work profile or container (e.g., Android Work Profile or iOS Managed Open In) isolates corporate apps and data from personal apps, allowing selective wipe of corporate content without affecting personal data.

Exam trap

The trap here is that candidates often confuse MDM with MAM (Mobile Application Management) and assume MDM alone provides data isolation, when in fact a managed work profile or container is required for selective wipe and app-level separation.

Practice this question →
11
MCQhard

A contractor signs in to a project portal that fronts several SaaS tools. Access must be granted only if all of the following are true: the user is assigned to the project, the device is managed, and the request occurs during the approved maintenance window. Which access model best supports this requirement?

A.Role-based access control because the contractor has one project role
B.Attribute-based access control because multiple runtime attributes determine access
C.Single sign-on because the user should not log in more than once
D.Privileged access management because the contractor needs temporary access
AnswerB

ABAC is the best fit because the decision depends on several attributes evaluated dynamically: user assignment, device status, and time of request. This lets the organization express a policy that is more precise than a static role and better aligned to least privilege. In a federated portal, ABAC can also work alongside identity assertions to make access decisions at sign-in and during session use.

Why this answer

Attribute-based access control (ABAC) evaluates multiple runtime attributes—such as user-project assignment, device management status, and time of request—against policies to grant access. This matches the requirement because all three conditions must be true simultaneously, and ABAC can combine subject, resource, and environment attributes in a single policy rule. Role-based access control (RBAC) would only check the user's role, not device or time attributes.

Exam trap

The trap here is that candidates see 'contractor' and 'project' and immediately think of RBAC roles, overlooking that the requirement explicitly demands evaluation of multiple runtime attributes (device managed, maintenance window) which only ABAC can handle dynamically.

How to eliminate wrong answers

Option A is wrong because RBAC grants access based solely on a user's role (e.g., 'contractor'), not on dynamic runtime attributes like device management status or time of day; it cannot enforce the multi-condition logic required. Option C is wrong because single sign-on (SSO) only provides a unified authentication experience (e.g., using SAML or OIDC) and does not enforce authorization policies based on device or time attributes. Option D is wrong because privileged access management (PAM) is designed to control and audit elevated access (e.g., admin credentials or just-in-time privileges), not to evaluate general access conditions like project assignment or device compliance.

Practice this question →
12
MCQeasy

A team is moving an application to a cloud provider. The cloud provider will secure the physical data center and core infrastructure, while the company must still secure its own application settings and user access. What concept does this describe?

A.Fail-open design
B.Shared responsibility model
C.Air gap
D.Data masking
AnswerB

The shared responsibility model is the framework that defines how cloud security duties are split: the provider secures the physical infrastructure, hardware, network, and hypervisor, while the customer secures data, identities, access policies, and configurations, with the exact boundary depending on the service model (IaaS, PaaS, or SaaS). When migrating an application to the cloud, this model tells you which security controls you still own and which the provider manages. That is precisely why it is the correct answer.

Why this answer

The shared responsibility model defines the division of security obligations between a cloud provider and its customer. In this scenario, the provider secures the physical data center and core infrastructure (the 'security of the cloud'), while the company retains responsibility for application settings and user access (the 'security in the cloud'). This model is foundational to all major cloud providers, including AWS, Azure, and Google Cloud.

Exam trap

The trap here is that candidates often confuse the shared responsibility model with a simple 'provider does everything' or 'customer does everything' approach, failing to recognize that security obligations are split based on the service model (IaaS, PaaS, SaaS) and that the customer always retains responsibility for data and access management.

How to eliminate wrong answers

Option A is wrong because a fail-open design refers to a security mechanism that defaults to allowing access when it fails (e.g., a firewall that passes all traffic upon crash), not to the division of security responsibilities in cloud computing. Option C is wrong because an air gap is a physical or logical isolation of a network from unsecured networks (e.g., no network connection at all), which is unrelated to the shared security duties between a cloud provider and its customer. Option D is wrong because data masking is a technique used to obfuscate sensitive data (e.g., replacing real credit card numbers with fictitious ones for testing), not a model for distributing security controls between parties.

Practice this question →
13
MCQmedium

Based on the exhibit, which network change best isolates finance workstations from general user PCs while still allowing printing and application access? VLAN table: - VLAN 20 Users: 10.20.20.0/24 - VLAN 30 Finance: 10.20.30.0/24 - VLAN 40 Printers: 10.20.40.0/24 - VLAN 50 Accounting App: 10.20.50.0/24 Current SVI routing policy: permit ip any any Management goal: Finance devices must not initiate traffic to User VLAN 20, but they must be able to print and access the accounting application.

A.Put finance workstations on the same VLAN as the printers to simplify access.
B.Add inter-VLAN ACLs that deny Finance VLAN access to User VLAN 20 while permitting Finance VLAN traffic to VLAN 40 and VLAN 50.
C.Remove routing between all VLANs and let users print through email attachments.
D.Place the accounting application in the User VLAN so finance devices no longer need segmentation.
AnswerB

This is the best option because it keeps the finance systems isolated from general user devices while still allowing the required business functions. The ACL can allow only the exact destinations and services needed for printing and the accounting application, which reduces lateral movement risk without breaking the workflow. It is a practical example of subnet isolation with traffic filtering.

Why this answer

It uses inter-VLAN ACLs to enforce the principle of least privilege: denying traffic from the Finance VLAN (10.20.30.0/24) to the User VLAN (10.20.20.0/24) while explicitly permitting traffic to the Printer VLAN (10.20.40.0/24) and the Accounting App VLAN (10.20.50.0/24). This preserves the required segmentation and still allows the necessary services (printing and application access) without altering the existing VLAN structure or routing policy.

Exam trap

The trap here is that candidates often assume VLANs alone provide security isolation, forgetting that by default inter-VLAN routing permits all traffic (as shown by the 'permit ip any any' SVI policy), so additional ACLs are required to enforce directional restrictions while still allowing specific services.

How to eliminate wrong answers

Option A is wrong because placing finance workstations on the same VLAN as printers would collapse segmentation, allowing unrestricted traffic between finance devices and printers, and would not isolate finance from user PCs—it also violates the management goal of preventing finance-initiated traffic to the User VLAN. Option C is wrong because removing routing between all VLANs would completely block inter-VLAN communication, preventing finance devices from accessing the printers and accounting application, which directly contradicts the requirement to allow printing and application access. Option D is wrong because placing the accounting application in the User VLAN would expose it to all user PCs, defeating the purpose of segmentation and potentially allowing unauthorized access from the User VLAN to the application, while still not isolating finance workstations from user PCs.

Practice this question →
14
Multi-Selectmedium

A regulated analytics workload is moving to a public cloud. The business wants the strongest practical tenant isolation without managing physical servers, and it also needs an audit trail for changes made to the cloud environment. Which two design choices best meet those requirements? Select two.

Select 2 answers
A.Place the workload in a dedicated account, project, or subscription with restricted cross-account access.
B.Enable cloud control-plane logging and retain the logs centrally.
C.Deploy the workload in a shared public subnet to simplify routing between tenants.
D.Assume the cloud provider will record every guest operating system event automatically.
E.Disable logging to reduce storage costs because the provider already has all necessary records.
AnswersA, B

A dedicated account, project, or subscription provides stronger logical isolation than placing the workload in a shared environment. Restricting cross-account access reduces accidental or unauthorized sharing and makes governance easier. This is a common cloud architecture pattern for regulated workloads that need separation without the overhead of managing physical infrastructure.

Why this answer

Placing the workload in a dedicated account, project, or subscription with restricted cross-account access provides strong logical isolation at the cloud provider's control plane. This approach meets the requirement for tenant isolation without managing physical servers, as it leverages the provider's built-in resource boundaries and IAM policies to prevent unauthorized access between tenants.

Exam trap

The trap here is that candidates often confuse network-level isolation (like subnets) with tenant isolation at the control plane, or assume cloud providers automatically handle guest OS auditing, leading them to select C or D instead of the correct combination of A and B.

Practice this question →
15
Multi-Selectmedium

A help desk manager is hardening a fleet of Windows laptops. The goal is to prevent booting from untrusted external media and to ensure only approved software can run on the devices. Which two controls best address those goals? Select two.

Select 2 answers
A.Enable Secure Boot in firmware.
B.Implement application allowlisting or application control.
C.Rely only on full-disk encryption to stop unauthorized boot code.
D.Increase the screen-lock timeout so users are interrupted less often.
E.Use a stronger Wi-Fi password so malware cannot start.
AnswersA, B

Secure Boot helps ensure the device only starts trusted boot components that are signed by a trusted key. That reduces the risk of booting unapproved loaders or malicious recovery media. It is a platform hardening control that directly addresses firmware-level trust during startup, which is exactly what the scenario calls for.

Why this answer

Secure Boot is a UEFI firmware feature that verifies the digital signature of the bootloader against a database of trusted signatures stored in the firmware. By enabling Secure Boot, the system will refuse to boot from any external media (e.g., USB drives) that does not have a valid, trusted signature, directly preventing unauthorized boot code from executing.

Exam trap

The trap here is that candidates often confuse full-disk encryption with boot security, mistakenly thinking encryption prevents unauthorized boot media, when in fact encryption only protects data confidentiality and does not control the boot process or software execution.

Practice this question →
16
MCQeasy

Before applying a major patch to a virtual machine, the administrator wants a quick way to return the VM to its exact pre-change state if the patch fails. What should the administrator create?

A.A full backup to removable media
B.A snapshot of the virtual machine
C.A separate VLAN for the virtual machine
D.A digital certificate for the patch server
AnswerB

A snapshot captures the VM state at a specific moment, making rollback fast after a failed patch.

Why this answer

A snapshot captures the exact state of the virtual machine (disk, memory, and power state) at a point in time, allowing the administrator to revert instantly if the patch fails. This is the fastest and most storage-efficient method for a quick rollback compared to a full backup, which is slower and more resource-intensive.

Exam trap

The trap here is that candidates confuse a snapshot with a full backup, but the question emphasizes 'quick way to return to exact pre-change state,' which is the defining characteristic of a snapshot, not a backup.

How to eliminate wrong answers

Option A is wrong because a full backup to removable media is a slower, more cumbersome process that requires restoring the entire VM from external storage, not a quick revert. Option C is wrong because a separate VLAN isolates network traffic but does not preserve or restore the VM's operating system or application state. Option D is wrong because a digital certificate authenticates the patch server but provides no mechanism to revert the VM to a previous state.

Practice this question →
17
Multi-Selectmedium

A small enterprise is rebuilding its public customer portal. The web front end must be reachable from the internet, the application tier should never be directly exposed, and the database must remain private even if the web server is compromised. Which two design changes best meet those goals? Select two.

Select 2 answers
A.Place the web front end in a DMZ behind a firewall rule allowing only HTTPS from the internet.
B.Put the database on the same subnet as the web front end so internal calls have lower latency.
C.Place the application tier on an internal subnet and allow only the web front end to reach it on the app port.
D.Allow the database to accept connections from the internet if strong passwords are used.
E.Disable all inbound filtering on the DMZ so troubleshooting is simpler.
AnswersA, C

A DMZ is the correct place for the internet-facing web front end because it limits exposure if the server is attacked. Allowing only HTTPS from the internet reduces unnecessary access and supports a tight inbound filtering strategy. This choice fits a common secure web architecture pattern and keeps the higher-value internal systems separate from direct public reach.

Why this answer

Placing the web front end in a DMZ behind a firewall rule that permits only HTTPS (TCP/443) from the internet ensures the public-facing component is isolated from internal networks. This design prevents direct inbound access to the application or database tiers, reducing the attack surface while still allowing legitimate web traffic.

Exam trap

The trap here is that candidates often assume placing the database on the same subnet as the web server improves performance (Option B) without recognizing that it sacrifices security isolation, which is the primary goal in this scenario.

Practice this question →
18
MCQeasy

A laptop repeatedly starts with an unapproved bootloader, and the security team wants the firmware to refuse boot code that is not signed by a trusted key. Which feature should be used?

A.Secure Boot.
B.BitLocker full-disk encryption.
C.A DHCP reservation.
D.A local administrator password policy.
AnswerA

This is the best answer because Secure Boot verifies that boot components are signed by trusted keys before allowing them to load. That helps prevent bootkits and other pre-boot tampering from taking control before the operating system starts. It is a core platform hardening feature on modern systems and directly addresses trust in the boot process.

Why this answer

Secure Boot is a UEFI firmware feature that verifies the digital signature of bootloaders and kernel code against a database of trusted keys before allowing execution. By configuring Secure Boot to only accept boot code signed by a trusted key, the firmware will reject any unapproved bootloader, preventing unauthorized code from running during the boot process.

Exam trap

The trap here is that candidates often confuse Secure Boot with BitLocker, thinking that disk encryption also verifies boot integrity, but BitLocker only protects data after the OS loads and does not validate the bootloader's signature.

How to eliminate wrong answers

Option B is wrong because BitLocker full-disk encryption protects data at rest by encrypting the entire drive, but it does not validate the integrity or signature of boot code before execution. Option C is wrong because a DHCP reservation assigns a fixed IP address to a device based on its MAC address and has no role in verifying bootloader signatures or firmware-level security. Option D is wrong because a local administrator password policy controls password complexity and expiration for local user accounts, but it does not enforce cryptographic verification of boot components.

Practice this question →
19
MCQmedium

A small company is deploying a public web application with a front-end server, an API server, and a database. The web server must be reachable from the internet, the API must be reachable only from the web server, and the database must never be accessible from user subnets. Which design best meets the requirement?

A.Place all three servers on the same internal VLAN and use host firewalls only.
B.Place the web server in a DMZ, the API server in an internal subnet, and the database in a separate restricted subnet.
C.Place the database in the DMZ so the web server can connect to it with fewer firewall rules.
D.Use a single NAT gateway for all servers and rely on public IP filtering at the edge.
AnswerB

This architecture implements defense-in-depth by separating workloads into distinct trust zones: the web server sits in a demilitarized zone (DMZ) exposed to the internet, the API resides in an internal subnet, and the database is isolated in a restricted subnet with allow-list rules. The web server is the only component with direct internet exposure, while the API and database remain inaccessible from outside, and strict firewall policies govern east-west traffic between tiers. This containment limits the blast radius of a compromise, as an attacker who breaches the web server must still traverse multiple security controls to reach sensitive data.

Why this answer

It implements a layered security architecture: the web server resides in a DMZ (demilitarized zone) to be publicly accessible, the API server is placed in an internal subnet with firewall rules allowing only traffic from the web server, and the database is isolated in a restricted subnet with no access from user subnets. This design enforces the principle of least privilege and prevents direct internet exposure of the API and database, which is critical for protecting sensitive data.

Exam trap

The trap here is that candidates often think placing the database in the DMZ simplifies connectivity, but they overlook that the DMZ is inherently less secure and directly violates the requirement that the database must never be accessible from user subnets.

How to eliminate wrong answers

Option A is wrong because placing all three servers on the same internal VLAN with only host firewalls fails to isolate the database from the web server and API, and does not prevent direct internet access to the API or database if the web server is compromised. Option C is wrong because placing the database in the DMZ exposes it to the internet and increases the attack surface, violating the requirement that the database must never be accessible from user subnets. Option D is wrong because relying on a single NAT gateway and public IP filtering at the edge does not provide subnet-level segmentation; all servers would share the same public IP, making it impossible to restrict API access to only the web server and database access to internal subnets.

Practice this question →
20
Multi-Selecthard

A team is deploying a containerized API to a public cloud. The service must be reachable only by internal corporate applications, and secrets must not be embedded in images or readable as plaintext by administrators of the underlying host. Which two actions best fit the design? Select two.

Select 2 answers
A.Place the API in a private subnet and expose it only through an internal load balancer or private endpoint.
B.Give each container a public IP and restrict access by source IP allowlist.
C.Store secrets in a managed vault and retrieve them at runtime with short-lived IAM permissions.
D.Bake database passwords into the container image so deployment is simpler.
E.Assume the cloud provider's tenant isolation alone is enough to protect secrets from misuse.
AnswersA, C

Private subnets and internal endpoints keep the service off the public internet while still allowing controlled access from trusted corporate systems. This reduces exposure, simplifies firewall policy, and supports the requirement that only internal applications can reach the API. It is a common secure cloud architecture pattern for internal services.

Why this answer

Placing the API in a private subnet and exposing it only through an internal load balancer or private endpoint ensures that the service is reachable only by internal corporate applications, as traffic never traverses the public internet. This design leverages network segmentation and private IP addressing to enforce access control at the network layer, aligning with the requirement for internal-only reachability.

Exam trap

The trap here is that candidates often confuse network-level access control (public IP with allowlist) with true private connectivity, or they underestimate the risk of host administrators reading secrets from container images or environment variables, assuming that tenant isolation or encryption at rest alone is sufficient.

Practice this question →
21
MCQmedium

A company wants employees to use one corporate login for multiple SaaS applications, require MFA when users sign in from unmanaged devices, and centralize account lifecycle management. Which design best meets these requirements?

A.Create separate local usernames and passwords in each SaaS application.
B.Use shared accounts for each department and keep one password vault for the team.
C.Implement federated single sign-on through a central identity provider with MFA and conditional access policies.
D.Require all users to connect through a VPN before any SaaS login and remove identity federation.
AnswerC

Federated SSO lets the identity provider authenticate users once and pass trusted assertions to multiple SaaS apps. MFA can be enforced centrally, and conditional access can require additional controls based on device trust or location. This also simplifies account creation, removal, and policy management.

Why this answer

Federated single sign-on (SSO) through a central identity provider (IdP) like Azure AD or Okta allows employees to use one corporate login across multiple SaaS applications via protocols such as SAML 2.0 or OIDC. The IdP enforces MFA for unmanaged devices through conditional access policies (e.g., device compliance checks) and centralizes account lifecycle management by provisioning/deprovisioning users from a single directory (e.g., LDAP or SCIM).

Exam trap

The trap here is that candidates may confuse 'shared accounts' (Option B) with SSO, not realizing that shared accounts lack individual accountability and cannot enforce per-user MFA or conditional access policies.

How to eliminate wrong answers

Option A is wrong because creating separate local usernames and passwords in each SaaS application violates the requirement for a single corporate login, does not enforce MFA based on device trust, and fragments account lifecycle management across silos. Option B is wrong because shared accounts for each department break non-repudiation and audit trails, password vaults do not provide SSO or conditional access, and they fail to centralize lifecycle management per user.

Practice this question →
22
MCQeasy

A security team wants to know whether a workstation has drifted away from the approved hardened configuration after several months of changes. What should they use to compare the current state against the approved setup?

A.A file compression tool
B.A configuration baseline
C.A password vault
D.A network cable tester
AnswerB

A configuration baseline is a documented set of security and operational settings that define the approved, secure state for a system, such as CIS benchmarks or organizational hardening guidelines. Drift detection works by regularly collecting the current configuration (e.g., via agent or assessment tool) and comparing it to this baseline, flagging any differences as non-compliance. This baseline serves as the authoritative reference point, enabling automated or manual identification of unauthorized or unintended changes. Hence, a configuration baseline is the correct tool for detecting drift.

Why this answer

A configuration baseline is the approved hardened state of a system, typically captured as a snapshot of settings, registry keys, file permissions, and installed software. By comparing the current workstation state against this baseline using tools like Microsoft Security Compliance Toolkit or CIS-CAT, the team can detect drift—unauthorized changes that deviate from the secure configuration. This is the standard method for maintaining compliance and security posture over time.

Exam trap

The trap here is that candidates confuse a configuration baseline with a backup or recovery tool, thinking a file compression tool could somehow 'compare' states, when in fact baselines are specifically designed for compliance drift analysis.

How to eliminate wrong answers

Option A is wrong because a file compression tool (e.g., WinRAR, gzip) only reduces file size for storage or transfer; it cannot compare system configurations or detect drift from a security baseline. Option C is wrong because a password vault (e.g., KeePass, LastPass) securely stores credentials but has no capability to assess system hardening or compare configuration states.

Practice this question →
23
Multi-Selectmedium

A SaaS vendor hosts a customer relationship platform for multiple organizations. Your company wants to know which two responsibilities typically remain with the customer rather than the SaaS provider. Select two.

Select 2 answers
A.Assigning user roles and approving access within the tenant.
B.Protecting the organization's data classification and sharing rules.
C.Patching the provider's underlying database engine.
D.Maintaining the vendor's physical data center power and cooling.
E.Replacing the provider's hypervisors during maintenance windows.
AnswersA, B

Customer organizations usually remain responsible for deciding who gets access and what role each user receives inside the SaaS tenant. The provider supplies the platform, but the customer controls business authorization decisions. This is a core shared responsibility item because access mistakes often come from tenant configuration rather than provider infrastructure.

Why this answer

In a SaaS model, the customer retains administrative control over user identities, roles, and access permissions within their own tenant. The SaaS provider manages the underlying application and infrastructure, but the customer must configure role-based access control (RBAC) to enforce least privilege and approve access requests. This aligns with the shared responsibility model where identity and access management (IAM) at the application layer falls to the customer.

Exam trap

The trap here is that candidates often confuse infrastructure maintenance tasks (like patching databases or replacing hypervisors) with customer responsibilities, but in SaaS, the provider handles all underlying infrastructure while the customer only manages tenant-specific configurations and data governance.

Practice this question →
24
MCQhard

A supplier portal is browser-based and used by external partner companies. Each partner already has its own identity provider. The portal must trust assertions from those IdPs and avoid creating separate local passwords for each partner. Which integration is best?

A.Use LDAP directory synchronization for all partner users.
B.Use SAML 2.0 federation with trust relationships to the partner identity providers.
C.Use NTLM pass-through authentication to each partner account.
D.Use PAP over TLS so the portal can collect partner passwords securely.
AnswerB

SAML 2.0 federation establishes explicit trust relationships between the portal as a service provider and each partner identity provider through exchanged metadata and signing certificates. Users authenticate at their own IdP, which sends a digitally signed SAML assertion to the portal via browser redirects, enabling SSO without sharing passwords. This is the standard for cross-organization web single sign-on and directly satisfies the requirement for external partner browser access.

Why this answer

SAML 2.0 federation is the correct choice because it enables the supplier portal to trust assertions from multiple external identity providers (IdPs) without creating local passwords. SAML uses XML-based tokens signed by the partner's IdP, allowing the portal to accept authentication claims via a trust relationship, which directly meets the requirement of avoiding separate local credentials for each partner.

Exam trap

The trap here is that candidates may confuse LDAP synchronization (which replicates accounts) with federation (which avoids storing accounts), or mistakenly think NTLM can be extended across organizational boundaries, when in fact NTLM is a legacy challenge-response protocol limited to a single Windows domain.

How to eliminate wrong answers

Option A is wrong because LDAP directory synchronization would require the supplier to replicate partner user directories into a local LDAP store, which still creates local accounts and passwords, violating the requirement to avoid separate local passwords. Option C is wrong because NTLM pass-through authentication is a Windows-specific protocol designed for on-premises Active Directory environments and cannot be used to federate with external partner identity providers over the internet.

Practice this question →
25
MCQmedium

A team hosts a confidential document repository on an IaaS virtual machine. The provider secures the datacenter, hardware, and hypervisor. The organization wants to control who can decrypt the files and be able to revoke that access without changing providers. Which control is best?

A.Use the provider's default managed encryption keys for the storage service.
B.Rely on security groups and network ACLs to protect the document contents.
C.Use customer-managed encryption keys in the cloud KMS or HSM.
D.Enable automated snapshots so deleted files can be restored later.
AnswerC

Customer-managed encryption keys in a cloud KMS or HSM give the organization direct control over key rotation, revocation, and usage policies. When a key is revoked, the ciphertext remains but is effectively undecryptable, enabling crypto-shredding and independent revocation even if the provider's infrastructure is compromised. The provider performs cryptographic operations but does not own or solely govern the key material, strengthening separation of duties and meeting compliance requirements for confidential repositories. This is the correct control for enforcing that only the organization can grant or deny access to the document contents.

Why this answer

Customer-managed encryption keys (CMEK) in a cloud KMS or HSM allow the organization to retain control over key material, enabling them to decrypt files and revoke access independently of the cloud provider. This meets the requirement to control decryption and revocation without changing providers, as the provider cannot access the keys. In contrast, provider-managed keys do not offer the same level of tenant-controlled revocation.

Exam trap

The trap here is that candidates often confuse network access controls (security groups/ACLs) with encryption-based access control, failing to recognize that only cryptographic controls can enforce decryption revocation independently of the provider.

How to eliminate wrong answers

Option A is wrong because provider-managed default encryption keys give the organization no ability to independently revoke access to the encrypted files; the provider retains control over the key lifecycle. Option B is wrong because security groups and network ACLs are network-layer controls that protect access to the VM but do not encrypt the document contents or control decryption; they cannot enforce file-level decryption revocation. Option D is wrong because automated snapshots provide backup and recovery capabilities but do not control decryption or enable revocation of access to encrypted files.

Practice this question →
26
Multi-Selecteasy

A team is moving a workload to infrastructure as a service (IaaS). Which two items are usually the customer's responsibility? Select two.

Select 2 answers
A.Patch the guest operating system running on the cloud virtual machine.
B.Replace failed power supplies in the cloud provider's data center.
C.Configure the application's user permissions and access settings.
D.Maintain the cloud provider's hypervisor firmware.
E.Manage the physical firewall blades inside the provider's facility.
AnswersA, C

In IaaS, the customer retains responsibility for the guest OS, including applying security patches and kernel updates, because the cloud provider only delivers virtualized compute resources rather than a managed platform. Unpatched guest OSes are a leading exploitation vector, as known CVEs in services like SSH or web servers can be trivially attacked from the network. The provider manages the host and hypervisor, but not the OS running inside the VM, so patching is squarely on the customer.

Why this answer

In an IaaS model, the customer is responsible for managing the guest operating system, including applying security patches and updates. This is because the cloud provider only manages the underlying physical infrastructure and hypervisor, while the customer controls the OS and applications running on the virtual machine.

Exam trap

The trap here is that candidates often confuse IaaS with PaaS or SaaS, mistakenly thinking the provider handles all OS-level patching, but in IaaS, the customer retains full control and responsibility for the guest OS and application configuration.

Practice this question →
27
MCQmedium

An online retailer is redesigning its public web application so the web server can receive internet traffic, the application server can only be reached by the web tier, and the database server can only be reached by the application tier. Which placement best supports this design?

A.Place all three servers on the same private subnet and control access only with strong passwords.
B.Put the web server in a public zone, the application server in a private zone, and the database server in an isolated internal zone.
C.Put the database in the public zone so the web tier can query it directly from the internet.
D.Use a single reverse proxy for all three servers and disable network segmentation to simplify management.
AnswerB

This tiered placement supports a classic defense-in-depth design. The web server is internet-facing, the application tier is not directly exposed, and the database is placed in the most restricted zone. Network rules then allow only the necessary north-south and east-west traffic between tiers.

Why this answer

It implements a classic three-tier architecture with network segmentation. The web server in a public zone (DMZ) accepts internet traffic, the application server in a private zone is isolated from direct internet access and only reachable by the web tier, and the database server in an isolated internal zone is only reachable by the application tier. This design enforces the principle of least privilege and minimizes the attack surface by using firewalls or security groups to restrict traffic between tiers.

Exam trap

The trap here is that candidates often confuse 'private subnet' with 'security' and fail to recognize that without network segmentation, a single compromised server can lead to full lateral access, or they mistakenly think placing the database in a public zone is acceptable for direct queries.

How to eliminate wrong answers

Option A is wrong because placing all three servers on the same private subnet with only strong passwords fails to provide network segmentation; if the web server is compromised, an attacker can directly access the application and database servers without any network-level barriers. Option C is wrong because placing the database in the public zone exposes it directly to the internet, violating the requirement that the database server can only be reached by the application tier and creating a severe security risk. Option D is wrong because using a single reverse proxy for all three servers and disabling network segmentation eliminates the isolation between tiers, allowing an attacker who compromises the proxy to reach all servers directly, contradicting the design requirement.

Practice this question →
28
Multi-Selecthard

A development team runs multiple customer workloads in a shared Kubernetes cluster. Security wants to reduce the risk that one compromised container can read another team's data or deploy an altered image. Which three actions best improve the design? Select three.

Select 3 answers
A.Require signed, scanned images from an approved registry before deployment.
B.Run each container as root so file permissions inside the container do not block apps.
C.Use namespaces and network policies to separate the workloads by trust zone.
D.Mount the host filesystem into every pod so support staff can troubleshoot more quickly.
E.Run containers with the minimum Linux capabilities and a read-only root filesystem where possible.
AnswersA, C, E

Image signing and scanning help ensure the cluster only deploys trusted builds that have been checked for known vulnerabilities. Using an approved registry adds supply-chain control and reduces the chance of pulling tampered or unreviewed images. This directly addresses the risk of altered or unsafe container content entering production.

Why this answer

Requiring signed, scanned images from an approved registry ensures that only trusted, vulnerability-free images are deployed. Image signing (e.g., using Docker Content Trust or Notary) verifies the image's integrity and origin, preventing tampered images from being deployed. Scanning catches known vulnerabilities before runtime, reducing the attack surface.

This directly addresses the risk of deploying an altered image.

Exam trap

The trap here is that candidates often think running containers as root is necessary for app functionality, but Kubernetes security best practices (and the CIS Benchmark for Kubernetes) explicitly require running containers with non-root users and read-only root filesystems to limit damage from a compromise.

Practice this question →
29
MCQmedium

A security architect is designing the wireless network for a new branch office. The branch will have two types of users: employees who need access to internal corporate resources, and guests who need internet-only access. The architect plans to use WPA3-Enterprise for the employee SSID and WPA3-SAE for the guest SSID. Which of the following additional configurations is MOST critical to prevent guests from accessing internal corporate resources?

A.Implement MAC address filtering on the guest SSID to allow only authorized guest devices.
B.Place the guest wireless network on a separate VLAN with a firewall rule blocking inbound traffic to the corporate VLAN.
C.Disable SSID broadcast for the guest network to make it less discoverable.
D.Require guests to accept a captive portal agreement before gaining internet access.
AnswerB

This is the most critical control because it enforces network segmentation at Layer 3: the guest VLAN has its own IP subnet and routing context, and the firewall rule explicitly denies any inbound traffic from the guest VLAN to the corporate VLAN. This prevents a guest device from directly reaching internal resources even if the wireless password is shared or compromised, because all inter-VLAN traffic must traverse the firewall, where the policy is enforced. Additionally, the guest VLAN can be configured with a default route only to the internet, typically via NAT, so guests get connectivity while the corporate network remains logically invisible and unreachable from the guest segment.

Why this answer

The most critical configuration is to isolate the guest network from the corporate network. Placing the guest SSID on a separate VLAN and implementing a firewall rule that blocks inbound traffic from the guest VLAN to the corporate VLAN ensures that even if a guest device is compromised or malicious, it cannot initiate connections to internal corporate resources. This leverages network segmentation and access control lists (ACLs) to enforce the principle of least privilege.

Exam trap

The trap here is that candidates focus on wireless security protocols (WPA3-SAE vs. Enterprise) or SSID hiding, but the exam tests the understanding that network segmentation and firewall rules are the critical controls for preventing unauthorized access between different trust zones, regardless of the wireless encryption method used.

Why the other options are wrong

A

MAC address filtering does not prevent guests from accessing internal resources; it only controls which devices can connect to the guest SSID. Once connected, guests could still reach corporate resources if network segmentation is not enforced.

C

Disabling SSID broadcast does not prevent guests from accessing internal resources; it only hides the network name from passive scans, which is a weak security measure easily bypassed.

D

A captive portal agreement only provides legal consent and does not enforce network segmentation; guests could still access corporate resources if they are on the same VLAN or subnet.

Practice this question →
30
Multi-Selectmedium

A company wants employees to sign in once to several SaaS apps, while the security team also wants to require extra verification when users sign in from unmanaged devices or unusual locations. Which two architecture changes best satisfy both requirements? Select two.

Select 2 answers
A.Federate authentication to a central identity provider.
B.Enable conditional access policies based on device posture and sign-in risk.
C.Create separate passwords for each SaaS app so compromise is contained.
D.Turn off MFA because single sign-on already reduces logins.
E.Use shared generic accounts for contractors to simplify onboarding.
AnswersA, B

Federation allows the organization to centralize authentication and give users a single identity across multiple SaaS applications. That is the architectural foundation for single sign-on because the SaaS apps trust the central identity provider instead of storing separate credentials. It also makes access governance easier because one identity system can enforce stronger controls and lifecycle management.

Why this answer

Federating authentication to a central identity provider (IdP) enables single sign-on (SSO) across multiple SaaS apps using standards like SAML 2.0 or OIDC. This allows employees to sign in once, while the IdP becomes a centralized point to enforce additional security controls.

Exam trap

The trap here is that candidates may think SSO eliminates the need for MFA or that separate passwords improve security, but the question specifically requires both single sign-on and extra verification for risky scenarios, which only federation plus conditional access can deliver.

Practice this question →
31
MCQmedium

Based on the exhibit, which logging capability should be enabled first to create an audit trail for cloud administration changes? Exhibit: 2026-04-25 09:14:03 iam:AttachRolePolicy user=alice 2026-04-25 09:15:10 ec2:AuthorizeSecurityGroupIngress user=alice 2026-04-25 09:16:22 s3:PutBucketPolicy user=alice Requirement: Security wants to track management-plane API calls and configuration changes across cloud resources.

A.Enable cloud control-plane audit logging such as CloudTrail or the provider equivalent.
B.Install a rootkit detector on each workload and ignore management-plane activity.
C.Capture only DNS traffic, because it reveals all admin changes indirectly.
D.Rely on manual change tickets in a spreadsheet because cloud platforms do not record useful logs.
AnswerA

This is the best choice because the exhibit shows API-level changes to identity, networking, and storage policies. Control-plane audit logging records who made those changes, what action was taken, and when it occurred. That creates the most useful evidence for investigations, change tracking, and compliance in a cloud environment.

Why this answer

Cloud control-plane audit logging (e.g., AWS CloudTrail, Azure Monitor, or GCP Cloud Audit Logs) captures all management-plane API calls—such as IAM role attachments, security group rule changes, and bucket policy modifications—as shown in the exhibit. This directly meets the requirement to track configuration changes across cloud resources, providing a tamper-proof audit trail for security and compliance.

Exam trap

The trap here is that candidates may confuse data-plane logging (e.g., VPC Flow Logs or DNS logs) with management-plane logging, or assume manual processes are sufficient, when the exhibit clearly shows API-level events that only a control-plane audit service can capture.

How to eliminate wrong answers

Option B is wrong because rootkit detectors focus on workload-level threats (e.g., malware in virtual machines) and do not log management-plane API calls or configuration changes; they ignore the control plane entirely. Option C is wrong because DNS traffic only reveals domain resolution queries, not the specific API calls or resource modifications made by administrators; it cannot reconstruct an audit trail of cloud administration changes. Option D is wrong because manual change tickets are error-prone, lack automation, and cannot capture the granular, timestamped API calls that cloud platforms natively log; relying on spreadsheets violates the principle of automated audit trails required for compliance.

Practice this question →
32
Multi-Selecthard

A cloud support team is replacing separate logins for several internal apps. The new design must support one sign-in, reduce the chance that a stolen session remains valid too long, and let the identity team revoke access centrally after termination. Which three controls best fit? Select three.

Select 3 answers
A.Implement SSO through federation with the identity provider as the source of truth.
B.Configure short idle and absolute session timeouts with reauthentication for sensitive actions.
C.Use MFA so the initial authentication requires something the user has or is.
D.Keep app-specific local accounts so each application can manage sessions independently.
E.Disable centralized logout so active sessions are never interrupted during maintenance.
AnswersA, B, C

Federation and SSO let one identity provider authenticate the user and then assert that identity to connected applications. This eliminates repeated logins while keeping authentication centralized. It also makes termination and access changes easier because the identity team controls the authoritative account.

Why this answer

Implementing SSO through federation with the identity provider (IdP) as the source of truth allows users to sign in once and access multiple internal apps without separate logins. This design centralizes authentication, so when the identity team revokes access after termination, the IdP denies all subsequent token requests, effectively invalidating sessions across all apps. Federation typically uses SAML 2.0 or OIDC, where the IdP issues signed assertions or ID tokens that apps trust, eliminating the need for app-specific credentials.

Exam trap

The trap here is that candidates may think MFA alone (Option C) satisfies the requirement to reduce stolen session validity, but MFA only strengthens initial authentication and does not control session duration or enable centralized revocation after termination.

Practice this question →
33
MCQmedium

Based on the exhibit, which change would best reduce the attack surface of the public web server while preserving remote administration from the internal network?

A.Assign WEB01 a public IP address directly and remove the firewall rules.
B.Move WEB01 into a DMZ and allow only the reverse proxy or load balancer to reach it on HTTPS, with admin access limited to the jump host.
C.Place WEB01 on the same VLAN as user workstations so the firewall can inspect traffic more easily.
D.Keep the server where it is and add outbound web filtering to stop exploitation attempts.
AnswerB

A DMZ creates a separate trust boundary for the internet-facing service, limiting blast radius if the web server is compromised. Restricting inbound access to a proxy or load balancer reduces direct exposure, and allowing administration only from a jump host preserves controlled remote management. This is the strongest architectural improvement in the scenario.

Why this answer

Moving WEB01 into a DMZ and restricting inbound HTTPS traffic to only the reverse proxy or load balancer minimizes the server's exposure to the internet while still allowing external users to access the web application. Admin access from the internal network is preserved by limiting it to a jump host, which provides a controlled, audited entry point. This architecture follows the principle of least privilege and network segmentation, reducing the attack surface without sacrificing necessary functionality.

Exam trap

The trap here is that candidates often think placing a server on a separate VLAN or adding filtering is sufficient, but the key is using a DMZ with a reverse proxy to eliminate direct inbound connections and a jump host to control administrative access.

How to eliminate wrong answers

Option A is wrong because assigning a public IP directly to WEB01 and removing firewall rules would expose the server directly to the internet, vastly increasing the attack surface and eliminating all network-layer protection. Option C is wrong because placing WEB01 on the same VLAN as user workstations would bypass the firewall's ability to segment traffic, exposing the server to lateral movement from compromised workstations and violating the principle of network segregation. Option D is wrong because keeping the server in its current location and adding outbound web filtering does not reduce the inbound attack surface; it only attempts to mitigate exploitation after traffic reaches the server, leaving it directly accessible from the internet.

Practice this question →
34
MCQmedium

A security architect is redesigning the network for a payment card processing environment. The goal is to create a cardholder data environment (CDE) that is isolated from the rest of the corporate network to reduce PCI DSS scope. The CDE will contain only the payment application servers and the database storing credit card numbers. The architect must allow authorized administrators in the corporate network to perform updates and monitoring on the CDE servers. Which of the following network architecture designs provides the strongest isolation while still meeting the requirement for authorized administrative access?

A.Place the CDE servers on a separate subnet within the same VLAN as the corporate network, and rely on host-based firewalls on each server to deny all traffic except from specific administrative IP addresses.
B.Deploy a dedicated firewall that connects the corporate network to an isolated CDE segment. Configure firewall rules to allow only SSH and RDP from a specific jump box in the corporate network to the CDE servers, and deny all other inbound traffic from the corporate network.
C.Place the CDE servers on a separate VLAN with a Layer 3 switch that uses ACLs to allow only ICMP traffic from the corporate network to the CDE for monitoring, and require administrators to physically connect to the CDE network via a dedicated console server.
D.Connect the CDE servers directly to the internet through a web application firewall (WAF), and require all management access to occur through a cloud-based VPN with two-factor authentication.
AnswerB

A dedicated firewall provides strong network-level segmentation between the corporate network and the CDE. Using a jump box (bastion host) as the sole admin entry point limits exposure and allows for centralized logging and auditing. This design meets both isolation and authorized access requirements.

Why this answer

It uses a dedicated firewall to create a true network isolation boundary between the corporate network and the CDE, which is a core PCI DSS requirement for reducing scope. By allowing only SSH and RDP from a specific jump box, it enforces strict least-privilege administrative access while preventing any direct or uncontrolled traffic from the corporate network. This design ensures that the CDE is a separate, protected segment with a single controlled entry point, meeting both isolation and authorized access needs.

Exam trap

The trap here is that candidates often think VLANs with ACLs (Option C) provide sufficient isolation, but PCI DSS requires a clear network segmentation boundary enforced by a firewall, not just Layer 3 ACLs or host-based controls.

Why the other options are wrong

A

Placing CDE servers on a separate subnet within the same VLAN as the corporate network does not provide true isolation, as VLANs share the same broadcast domain and Layer 2 boundaries. Host-based firewalls are less secure than a dedicated network firewall and can be more easily misconfigured or bypassed, failing to meet PCI DSS requirements for strong segmentation.

C

Option C is wrong because allowing ICMP traffic from the corporate network to the CDE creates a potential attack vector (e.g., ICMP tunneling) and does not provide the required administrative access for updates and monitoring via SSH/RDP. Additionally, requiring physical connection via a console server is impractical for routine remote administration.

D

Connecting CDE servers directly to the internet, even with a WAF, exposes them to external threats and violates PCI DSS requirements for network segmentation and isolation of the CDE from untrusted networks.

Practice this question →
35
MCQmedium

A team moved a Linux VM to IaaS. They need OS login events, process activity, and network flow metadata sent to one central platform for alerting. What is the best first step?

A.Enable only perimeter security groups and assume the cloud provider will collect all host telemetry.
B.Deploy an endpoint logging agent and enable cloud-native flow logs to a centralized logging service.
C.Store the VM snapshots in object storage and review them manually during incidents.
D.Rely on the hypervisor console and disable guest-level logging to reduce overhead.
AnswerB

Deploying an endpoint logging agent on the VM captures systemd journal entries, /var/log/auth.log, and auditd records, yielding timestamps, usernames, source IPs, and session details for every login. Enabling cloud-native flow logs (e.g., VPC Flow Logs, Azure NSG flow logs) adds connection-level metadata, revealing failed auth traffic patterns and lateral movement. Sending both to a centralized logging service (CloudWatch Logs, Log Analytics, or a SIEM) supports real-time alerting, long-term retention, and efficient incident investigation.

Why this answer

Deploying an endpoint logging agent (e.g., auditd, osquery, or a SIEM agent) on the Linux VM captures OS login events and process activity at the guest level, while enabling cloud-native flow logs (e.g., AWS VPC Flow Logs, Azure NSG flow logs) provides network flow metadata. Sending both to a centralized logging service (e.g., AWS CloudWatch Logs, Azure Log Analytics, or a third-party SIEM) ensures all required telemetry is aggregated for alerting. This approach directly addresses the need for host-level and network-level visibility without relying on the cloud provider to collect guest OS internals.

Exam trap

The trap here is that candidates may assume cloud providers automatically collect guest OS telemetry (like login events and process activity) when they only provide infrastructure-level logs (e.g., hypervisor or network flow logs), leading them to choose Option A or D incorrectly.

How to eliminate wrong answers

Option A is wrong because perimeter security groups only filter network traffic at the cloud boundary and do not collect OS login events, process activity, or network flow metadata; the cloud provider does not automatically collect host-level telemetry from guest VMs. Option C is wrong because storing VM snapshots in object storage is a backup/recovery method, not a real-time logging solution, and manual review during incidents is too slow and impractical for continuous alerting. Option D is wrong because relying solely on the hypervisor console provides only hypervisor-level logs (e.g., VM start/stop), not guest OS login events or process activity, and disabling guest-level logging removes the very data needed for security monitoring.

Practice this question →
36
MCQhard

A company runs payroll and HR application servers on the same VLAN because a redesign is not possible this quarter. Security wants to reduce lateral movement if one workload is compromised, but the team cannot renumber the environment or add new physical firewalls. Which control best fits the requirement?

A.Move the servers into a single larger subnet so internal routing is simplified
B.Implement microsegmentation with host-based or distributed firewall rules between workloads
C.Place the servers behind a network address translation device to hide their IP addresses
D.Rely on password rotation and MFA for administrative logins only
AnswerB

Microsegmentation is the best fit when the organization cannot redesign the network but still needs to isolate workloads more tightly. Host-based or distributed firewall rules can restrict east-west traffic between individual servers, even when they share the same VLAN. That reduces lateral movement far better than coarse VLAN-only separation and does not require renumbering the environment.

Why this answer

Microsegmentation using host-based or distributed firewall rules (e.g., via a hypervisor firewall or host firewall policies) allows the security team to enforce zero-trust east-west traffic controls between the payroll and HR servers without changing the VLAN, subnet, or adding physical firewalls. This directly reduces lateral movement by restricting communication to only what is necessary, even though both workloads share the same Layer 2 broadcast domain.

Exam trap

The trap here is that candidates often assume VLAN segmentation is the only way to isolate workloads, but the question explicitly prevents renumbering or adding firewalls, so the correct answer leverages host-based or distributed firewall rules to achieve microsegmentation without changing the network topology.

How to eliminate wrong answers

Option A is wrong because moving servers into a single larger subnet simplifies routing but does nothing to restrict lateral movement between workloads; in fact, it may increase the attack surface by placing more hosts in the same broadcast domain. Option C is wrong because placing servers behind a NAT device hides their IP addresses from external networks but does not restrict traffic between the two servers on the same VLAN; NAT operates at Layer 3/4 and does not enforce host-to-host segmentation within the same subnet. Option D is wrong because password rotation and MFA protect administrative logins but do not prevent a compromised workload from moving laterally to another server; they address authentication, not network-level or host-level traffic filtering.

Practice this question →
37
Matchingmedium

A company is redesigning how systems are separated in its office and data center network. Match each network design element to the scenario it best supports. Use each term once.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

A subnet that hosts public-facing web servers while keeping them separated from the internal LAN.

Separating finance and engineering workstations on the same switches into different broadcast domains.

A rule set that allows only TCP 8443 from the web tier to the application tier and denies everything else.

Restricting east-west traffic between individual workloads inside the same data center or cloud cluster.

Grouping systems that share similar security requirements and access assumptions for policy design.

Why these pairings

VLANs separate broadcast domains, subnets divide IP networks, ACLs filter traffic, DMZs isolate public servers, VPNs provide secure remote access, and NAT translates private to public IPs.

Practice this question →
38
MCQmedium

Based on the exhibit, which identity architecture change best addresses the repeated password resets and delayed offboarding across the company's SaaS applications? Exhibit: - SaaS A uses local user accounts - SaaS B uses local user accounts - SaaS C supports SAML and automated provisioning - Help desk reports 120 password reset tickets per month - Former employees can remain active in two apps for up to 24 hours after termination Management wants one sign-in and faster deprovisioning.

A.Implement federated SSO with the enterprise identity provider and automated provisioning for SaaS users.
B.Create one shared account for each application and store the passwords in a vault.
C.Keep local accounts in every SaaS app and reset passwords whenever staff change roles.
D.Put the SaaS apps behind a network firewall and use source IP filtering instead of identity.
AnswerA

This is the best answer because federation centralizes authentication, and automated provisioning improves lifecycle management. Users sign in once through the identity provider, reducing password fatigue and help desk resets. When accounts are created, modified, or removed centrally, access changes can reach supported applications much faster, which helps with offboarding and reduces orphaned access.

Why this answer

Implementing federated SSO with the enterprise identity provider (IdP) centralizes authentication, allowing users to sign in once. Combined with automated provisioning (SCIM), it enables near-instant deprovisioning when an employee is terminated, eliminating the 24-hour delay and reducing password reset tickets by removing the need for local account management.

Exam trap

The trap here is that candidates confuse network-layer controls (firewall, IP filtering) with identity-layer solutions, failing to recognize that only federated SSO with automated provisioning addresses both single sign-in and rapid deprovisioning across SaaS apps.

How to eliminate wrong answers

Option B is wrong because shared accounts violate the principle of least privilege and non-repudiation; password vaults do not solve delayed offboarding or reduce password resets, as shared credentials still require manual rotation and do not integrate with identity lifecycle management. Option C is wrong because keeping local accounts and resetting passwords on role changes does not address the 120 monthly password reset tickets (it perpetuates them) and fails to provide faster deprovisioning, as local accounts remain active until manually disabled. Option D is wrong because network firewall and source IP filtering control access at the network layer, not the identity layer; they cannot enforce per-user authentication, single sign-on, or automated deprovisioning, and former employees could still access apps from allowed IPs.

Practice this question →
39
MCQmedium

A customer portal runs on a single application server behind a database cluster. Leadership wants the portal to keep working if that application server fails, but the budget is tight and the team wants the simplest design that can automatically fail over. What should they add?

A.A second application server configured as an active-passive failover pair with health checks.
B.A cold backup server that is started manually after the outage is detected.
C.A multi-region active-active deployment with global traffic steering.
D.Additional RAID storage in the application server to prevent service interruption.
AnswerA

An active-passive pair provides automatic failover for a single server failure without the cost and complexity of a larger multi-node design. Health checks let the standby take over when the primary becomes unavailable, which matches the stated availability goal and budget constraint.

Why this answer

An active-passive failover pair with health checks provides automatic failover at the lowest complexity and cost. The passive server remains on standby, and health checks (e.g., ICMP, TCP port checks, or HTTP GET requests) detect application server failure, triggering automatic IP or service takeover. This meets the requirement for automatic failover without the expense and complexity of active-active or multi-region designs.

Exam trap

The trap here is that candidates often confuse high availability with disaster recovery, assuming that a cold backup or RAID storage provides automatic failover, when in fact only a hot standby with health checks meets the automatic requirement without over-engineering the solution.

How to eliminate wrong answers

Option B is wrong because a cold backup server that is started manually does not provide automatic failover; it requires human intervention, which violates the requirement for automatic failover. Option C is wrong because a multi-region active-active deployment with global traffic steering is far more complex and expensive than needed for a single application server failure; it introduces DNS-level steering, cross-region replication, and higher operational overhead. Option D is wrong because additional RAID storage only protects against disk failure within the server, not against the entire application server failing; it does not provide any server-level redundancy or failover capability.

Practice this question →
40
MCQmedium

Based on the exhibit, which cloud service model best fits the application's operational and security requirements?

A.Infrastructure as a Service (IaaS), because it gives full control over the guest operating system.
B.Platform as a Service (PaaS), because it offloads OS and runtime maintenance while preserving application control.
C.Software as a Service (SaaS), because the organization would not need to maintain anything.
D.Colocation, because the team can place its own servers in a provider facility and manage everything directly.
AnswerB

PaaS fits the requirements because the provider manages the underlying platform, including OS patching, runtime maintenance, and scaling features. The development team can still deploy code and manage the application layer and data model, which matches the scenario. This is a strong secure-service-selection choice when the goal is to reduce patching burden without giving up application control.

Why this answer

The exhibit shows an application that requires the organization to manage the application code and data while offloading the underlying OS, runtime, and middleware maintenance. Platform as a Service (PaaS) provides this exact split: the cloud provider handles the OS patches, runtime updates, and infrastructure scaling, while the organization retains full control over the application deployment and configuration. This matches the requirement of preserving application control without the overhead of managing the guest OS.

Exam trap

The trap here is that candidates see 'full control' in option A and assume it is always better for security, but the question's requirement to offload OS maintenance makes PaaS the correct choice—IaaS would actually increase the security burden by requiring the organization to manage guest OS hardening and patching.

How to eliminate wrong answers

Option A is wrong because IaaS gives full control over the guest OS, but the requirement specifically states the organization does not want to manage the OS or runtime—IaaS would force them to handle patching, hardening, and maintenance of the OS, which contradicts the operational need. Option C is wrong because SaaS would offload everything, including application control, but the requirement explicitly says the organization must preserve control over the application code and data—SaaS removes that control entirely. Option D is wrong because colocation requires the organization to manage all hardware, OS, and software layers themselves, which is the opposite of offloading OS and runtime maintenance; it also introduces physical security and hardware lifecycle burdens not aligned with the stated requirements.

Practice this question →
41
Multi-Selecteasy

A company is building a public web app with three tiers. Internet users should reach only the web tier, and the app tier should never be reachable from the internet. Which two network design choices support this goal? Select two.

Select 2 answers
A.Place the web server in a DMZ or public-facing zone.
B.Allow inbound traffic from the internet directly to the application servers.
C.Restrict the application tier so only the web tier can initiate connections to it.
D.Put the database on the guest Wi-Fi VLAN.
E.Use the same flat network for all three tiers.
AnswersA, C

A DMZ is the standard perimeter network for internet-facing services because it provides a controlled buffer between untrusted public traffic and the internal corporate network. By placing the web server in the DMZ, you can open inbound TCP/80 and TCP/443 from the internet while using firewall rules to limit what the web server can access inside the boundary. This ensures that even if the web tier is compromised, the attack is contained to the DMZ and does not grant direct reach into the application or database layers. The DMZ design is a foundational defense-in-depth control for three-tier architectures.

Why this answer

Placing the web server in a DMZ (demilitarized zone) or public-facing zone allows internet traffic to reach only the web tier while isolating the internal network. This is a standard security architecture where the DMZ acts as a buffer, and firewall rules permit inbound HTTP/HTTPS (ports 80/443) only to the web servers, not to the application or database tiers.

Exam trap

The trap here is that candidates may think placing the app tier behind a firewall alone is sufficient, but they must also explicitly restrict inbound connections to only the web tier, not just block the internet—otherwise internal lateral movement or misconfigured rules could still expose the app tier.

Practice this question →
42
Matchingeasy

Match each cloud security concept to the best description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Defines which security tasks belong to the cloud provider and which remain with the customer

Separates one customer's cloud resources from another customer's resources

Uses the provider's logging service to record workload and control-plane activity

Places workload resources where they are not directly exposed to the internet

Why these pairings

Each cloud security concept is matched to its primary function: encryption protects data at rest or in transit, IAM manages access, SIEM provides event analysis, IDS detects intrusions, and DLP prevents data loss.

Practice this question →
43
Matchingeasy

Match each network segment to the best use in a small enterprise.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Network segment for internet-facing services such as a public web proxy or reverse proxy

Segment for internal systems such as databases that should not be directly reachable from the internet

Restricted network used for switch, firewall, and server administration traffic

Internet-only network for visitors and unmanaged devices

Why these pairings

Each segment serves a specific purpose: guest Wi-Fi for external users, DMZ for public services, internal LAN for daily operations, management for device control, data center for core infrastructure, VPN for secure remote access.

Practice this question →
44
Multi-Selecteasy

A branch office has users, finance workstations, and printers on the same LAN. Management wants finance devices isolated from general users while still allowing approved printing and internet access. Which two changes best meet this goal? Select two.

Select 2 answers
A.Put finance systems in a separate VLAN.
B.Use firewall or ACL rules between the VLANs.
C.Remove the default gateway from all finance devices.
D.Place all systems in one flat subnet.
E.Use hubs instead of switches to simplify traffic flow.
AnswersA, B

Creating a separate VLAN for finance systems establishes a Layer 2 logical boundary that isolates broadcast domains and restricts ARP-based reconnaissance. Any inter-VLAN traffic must be routed through a Layer 3 device, which inherently reduces lateral movement and allows the finance segment to be governed by distinct security policies, such as stricter access controls and monitoring. This is the foundational step for network segmentation and directly supports compliance requirements like PCI DSS.

Why this answer

Placing finance systems in a separate VLAN (Option A) segments the LAN into isolated broadcast domains, preventing general users from directly accessing finance workstations at Layer 2. This is a foundational step for network segmentation, as VLANs logically separate traffic without requiring physical re-cabling.

Exam trap

The trap here is that candidates often think VLANs alone provide security, forgetting that inter-VLAN routing is enabled by default on most switches, so ACLs or firewall rules are mandatory to actually restrict traffic between VLANs.

Practice this question →
45
MCQmedium

A web application needs to be internet-facing. The web tier must accept public traffic, the application tier should be reachable only from the web tier, and the database must be reachable only from the application tier. Which design best supports this?

A.Put all three tiers on one private subnet and rely on host firewalls.
B.Use a three-tier layout with a DMZ, an application zone, and a database zone separated by firewalls.
C.Place the database in the DMZ so the web tier has lower latency.
D.Use NAT for the database server and allow inbound access from the internet.
AnswerB

This is the standard security architecture for internet-facing web applications. The DMZ exposes only the web tier to the internet, the application tier is isolated in a private zone, and the database is in a further restricted zone. Firewalls enforce strict allow-lists between zones, so even if the web server is compromised, the attacker cannot directly access the database—they must go through the application tier, which provides an additional layer of defense and monitoring. This aligns with the principle of defense in depth.

Why this answer

It implements a classic three-tier architecture with separate security zones (DMZ, application zone, database zone) each protected by firewalls. This ensures that only the web tier in the DMZ accepts public traffic, the application tier is isolated and reachable only from the web tier via firewall rules, and the database tier is further isolated and reachable only from the application tier. This layered defense aligns with the principle of defense in depth and minimizes the attack surface by enforcing strict east-west traffic segmentation.

Exam trap

The trap here is that candidates may assume a single subnet with host firewalls is sufficient for segmentation, but CompTIA tests the understanding that network-level firewalls are required to enforce strict traffic flow between tiers and prevent lateral movement in a multi-tier architecture.

How to eliminate wrong answers

Option A is wrong because placing all three tiers on a single private subnet with only host firewalls fails to provide network-level segmentation; a compromise of the web server would allow direct lateral movement to the application and database servers, bypassing the intended access controls. Option C is wrong because placing the database in the DMZ exposes it directly to public traffic, violating the requirement that the database be reachable only from the application tier and increasing the risk of data exfiltration. Option D is wrong because using NAT for the database server and allowing inbound access from the internet directly contradicts the requirement that the database be reachable only from the application tier; this would expose the database to external threats.

Practice this question →
46
MCQmedium

A company is publishing an internet-facing customer portal that must also query an internal database containing order history. Security wants to reduce the chance that a compromise of the portal exposes the database directly. Which design is the best choice?

A.Place the database in the same subnet as the web server and rely on host-based antivirus.
B.Place the portal in a DMZ and keep the database on an internal network with firewall rules allowing only required traffic.
C.Use NAT so the internal database does not have a public IP address.
D.Move both systems behind a VPN and require users to authenticate before visiting the portal.
AnswerB

This is the correct architecture because it establishes a clear trust boundary: the web portal sits in a DMZ with limited access, while the database remains on an internal network with granular firewall rules permitting only the specific SQL service ports and source IPs from the portal. Even if the portal is compromised, the attacker faces an additional firewall layer that restricts traffic to the internal database, preventing direct internet exposure and minimizing the blast radius by requiring legitimate application flow only. This aligns with a defense-in-depth strategy that separates public-facing services from sensitive data stores.

Why this answer

Placing the portal in a DMZ and keeping the database on an internal network with firewall rules that permit only required traffic (e.g., specific ports like 1433/TCP for SQL Server or 3306/TCP for MySQL) creates a defense-in-depth architecture. This design ensures that even if the web server is compromised, the attacker cannot directly access the database from the internet, as the internal network is isolated by the firewall and only allows traffic from the DMZ to the database on necessary ports.

Exam trap

The trap here is that candidates often confuse NAT with a security control, thinking it hides the database from attackers, but NAT alone provides no access control or network segmentation, so a compromised portal can still reach the database if they share a network.

How to eliminate wrong answers

Option A is wrong because placing the database in the same subnet as the web server eliminates network segmentation, meaning a compromise of the portal would give an attacker direct Layer 2 access to the database, and host-based antivirus is insufficient to prevent lateral movement or database exploitation. Option C is wrong because NAT only translates private IP addresses to public ones; it does not provide security isolation or prevent an attacker from reaching the database if the portal is compromised, as the database still resides on the same network segment. Option D is wrong because moving both systems behind a VPN and requiring user authentication does not isolate the database from the portal; once authenticated, users (or an attacker who compromises the portal) would have direct network access to the database, violating the principle of least privilege and network segmentation.

Practice this question →
47
MCQeasy

A customer portal must continue operating if one application server fails. The business wants a simple, cost-conscious design that improves availability. What is the best approach?

A.Add a second application server behind a load balancer.
B.Schedule nightly backups to a different storage account.
C.Buy a larger server with more CPU and memory.
D.Move the portal to a different subnet without changing the servers.
AnswerA

This is the best answer because it adds redundancy and allows traffic to continue flowing if one application server goes down. A load balancer can route users to the healthy server, which improves availability without requiring a much more expensive architecture. For a simple portal, this is a practical fault-tolerance upgrade that reduces the impact of a single server failure.

Why this answer

Adding a second application server behind a load balancer creates an active-passive or active-active cluster that provides redundancy. If one server fails, the load balancer automatically redirects traffic to the healthy server, ensuring continuous operation. This design is cost-conscious because it uses commodity servers rather than expensive vertical scaling, and it directly improves availability by eliminating the single point of failure.

Exam trap

The trap here is that candidates often confuse data protection (backups) with high availability (redundancy), or they think vertical scaling (bigger server) is a simpler solution, but the exam specifically tests the concept of eliminating a single point of failure through horizontal scaling and load balancing.

How to eliminate wrong answers

Option B is wrong because nightly backups to a different storage account protect against data loss but do not provide real-time failover or maintain service availability during a server failure. Option C is wrong because buying a larger server (vertical scaling) still leaves a single point of failure; if that one server fails, the portal goes down regardless of its size. Option D is wrong because moving the portal to a different subnet changes the network topology but does not add redundancy or failover capability; the same single server remains the sole point of failure.

Practice this question →
48
MCQeasy

After a server rebuild, a Windows administrator notices several unneeded services are still enabled, including Remote Registry and Print Spooler on a server that only hosts a database. What should the administrator do to reduce attack surface and keep the build consistent?

A.Install additional endpoint monitoring agents to compensate for the extra services.
B.Apply the approved secure baseline and disable unnecessary services.
C.Increase the disk encryption key size to protect the running services.
D.Move the server to a different subnet and leave the configuration unchanged.
AnswerB

An approved secure baseline (e.g., CIS Benchmarks or Microsoft Security Baseline) specifies the required configuration settings, including which services, roles, and features must be disabled or removed to minimize the attack surface. By comparing the rebuilt server to this baseline and then stopping or removing non-essential services, the administrator directly eliminates unnecessary listening ports, background processes, and potential privilege escalation vectors. This is the proper remediation because it addresses the root cause: the server is running services beyond what its role requires.

Why this answer

Applying an approved secure baseline and disabling unnecessary services (Option B) directly reduces the attack surface by removing potential entry points like Remote Registry (which allows remote modification of the registry) and Print Spooler (which has known privilege escalation vulnerabilities, e.g., CVE-2021-34527). This also ensures build consistency by enforcing a standardized configuration across all servers, which is critical for compliance and manageability in a Windows environment.

Exam trap

The trap here is that candidates may think adding monitoring or moving subnets compensates for insecure configurations, but the SY0-701 exam emphasizes that reducing attack surface requires removing unnecessary services, not just detecting or isolating them.

How to eliminate wrong answers

Option A is wrong because installing additional endpoint monitoring agents does not reduce the attack surface; it only adds detection capability for threats that exploit the unneeded services, leaving the vulnerabilities in place. Option C is wrong because increasing disk encryption key size (e.g., from AES-128 to AES-256 for BitLocker) protects data at rest but does not affect running services or reduce the attack surface from enabled network-facing services. Option D is wrong because moving the server to a different subnet does not disable the unnecessary services; it only changes network segmentation, and the services remain enabled and exploitable if an attacker gains access to that subnet.

Practice this question →
49
MCQmedium

A company uses four cloud applications and wants employees to sign in once with corporate credentials. The applications should trust the company’s identity platform, and disabling a user in the directory should remove access everywhere without separate password resets. Which architecture should the team implement?

A.Create separate local accounts in each cloud application and synchronize passwords manually.
B.Use federation with single sign-on through the corporate identity provider, such as SAML or OpenID Connect.
C.Configure RADIUS authentication directly on each cloud application so users can reuse one password.
D.Store one shared administrator password for all users in a password vault.
AnswerB

Federation with SSO lets the company authenticate users centrally while each cloud application trusts assertions from the identity provider. That supports one login experience, faster deprovisioning, and consistent enforcement of corporate authentication controls across all apps.

Why this answer

Federation with single sign-on (SSO) using the corporate identity provider (IdP) via SAML or OpenID Connect allows users to authenticate once with their corporate credentials. The cloud applications trust the IdP, so disabling a user in the corporate directory immediately revokes access across all applications without requiring separate password resets. This architecture decouples authentication from the applications and centralizes identity management.

Exam trap

The trap here is that candidates confuse RADIUS (a network access protocol) with web SSO protocols like SAML or OpenID Connect, mistakenly thinking RADIUS can provide centralized web authentication and access revocation across cloud applications.

How to eliminate wrong answers

Option A is wrong because creating separate local accounts in each cloud application with manual password synchronization does not provide single sign-on, does not centralize identity management, and disabling a user in the directory would not automatically remove access everywhere—each application would need separate account management. Option C is wrong because RADIUS is a protocol for network access control (e.g., VPN, Wi-Fi) and is not designed for web application authentication; configuring RADIUS directly on each cloud application would not enable SSO with the corporate identity platform and would require separate password management per application.

Practice this question →
50
MCQmedium

A company is implementing network segmentation to isolate the guest wireless network from the internal corporate network. Which of the following technologies is most appropriate to enforce this separation at Layer 2?

A.VLANs
B.ACLs
C.DMZ
D.VPN
AnswerA

VLANs (Virtual Local Area Networks) partition a single physical switch into multiple isolated broadcast domains at Layer 2. By assigning guest wireless traffic to a dedicated VLAN, organizations can enforce logical separation from corporate network resources on the same infrastructure, preventing direct client-to-client communication across segments. This segmentation is fundamental because it operates independently of IP addressing and can be extended across switches using trunk links, with inter-VLAN routing only permitted when explicitly configured through a firewall or router. For guest wireless isolation, VLANs are the appropriate primary technology because they provide native Layer 2 isolation that other options cannot match.

Why this answer

VLANs (Virtual Local Area Networks) are the correct technology because they operate at Layer 2 (Data Link layer) of the OSI model, allowing network administrators to logically segment a physical switch into multiple isolated broadcast domains. By assigning the guest wireless network to a separate VLAN (e.g., VLAN 100) and the internal corporate network to another (e.g., VLAN 10), traffic between them is blocked at Layer 2 unless explicitly routed through a Layer 3 device with appropriate firewall rules. This directly enforces separation without requiring additional hardware, making VLANs the most appropriate and efficient choice for isolating guest traffic at Layer 2.

Exam trap

The trap here is that candidates often confuse ACLs as a Layer 2 solution because they are commonly used for filtering, but ACLs operate at Layer 3/4 and cannot create broadcast domain isolation; VLANs are the only Layer 2 mechanism listed that directly segments traffic at the Data Link layer.

Why the other options are wrong

B

ACLs operate at Layer 3 (IP) or Layer 4 (TCP/UDP), not Layer 2. They cannot enforce separation based on MAC addresses or VLAN tags, which is required for isolating guest wireless from corporate networks at Layer 2.

C

A DMZ is a network segment that hosts public-facing services, not a technology for Layer 2 separation between guest and internal networks. It operates at higher layers and does not enforce Layer 2 isolation.

D

VPNs operate at Layer 3 or above, encrypting traffic between endpoints over an untrusted network, but they do not enforce Layer 2 separation between networks. The question specifically asks for Layer 2 isolation, which VLANs provide by segmenting broadcast domains.

Practice this question →
51
Multi-Selecteasy

A web application must keep running if one application server fails. Management wants the simplest design that automatically switches traffic to a healthy server. Which two choices support that goal? Select two.

Select 2 answers
A.Place the application behind a load balancer with health checks.
B.Run the application on a single server with nightly backups.
C.Deploy at least two application servers in the same service pool.
D.Disable health checks to avoid false failovers.
E.Put the database on the public internet for easier access.
AnswersA, C

A load balancer can send traffic away from a failed server and toward healthy ones. Health checks are important because they let the platform detect when an instance should stop receiving requests.

Why this answer

A load balancer with health checks can automatically detect a failed application server and redirect traffic to healthy servers, ensuring continuous availability. This is the simplest design that meets the requirement for automatic failover without manual intervention. Health checks typically use HTTP/HTTPS probes or TCP port checks to verify server responsiveness.

Exam trap

The trap here is that candidates may think a single server with backups (Option B) provides high availability, but backups only protect data, not uptime, and failover requires redundant servers and automatic traffic switching.

Practice this question →
52
MCQeasy

A development team stores container images in a registry before deployment. Security wants to reduce the chance of shipping vulnerable libraries or packages inside the image. What should the team do before release?

A.Run the container as root so startup problems are less likely.
B.Scan the image and rebuild it from an approved base image.
C.Open the container port on the host firewall so the image can be reached faster.
D.Add more CPU and memory to the cluster to improve image security.
AnswerB

Scanning the image with a CVE-aware tool (e.g., Trivy, Grype) identifies known vulnerable packages before deployment, while rebuilding from an approved, hardened base image ensures the image starts from a patched and trusted foundation, eliminating many supply-chain risks. This is a preventive control that reduces the likelihood of an attacker exploiting a known flaw in runtime dependencies. The combination of automated scanning and trusted base images is a core DevSecOps practice.

Why this answer

Scanning the image for known vulnerabilities (CVEs) and rebuilding it from an approved, hardened base image ensures that only trusted, patched libraries and packages are included. This directly reduces the attack surface by eliminating vulnerable components before the image is deployed to production.

Exam trap

The trap here is that candidates may confuse operational practices (like running as root or opening ports) with security controls that directly address software supply chain risks, or mistakenly think that adding resources can compensate for insecure image content.

How to eliminate wrong answers

Option A is wrong because running containers as root violates the principle of least privilege and increases the risk of privilege escalation if the container is compromised. Option C is wrong because opening a container port on the host firewall does not affect the security of the image's contents; it only changes network accessibility and may increase exposure. Option D is wrong because adding CPU and memory resources does not address software vulnerabilities; resource allocation has no impact on the security of libraries or packages within the image.

Practice this question →
53
MCQeasy

A customer portal must keep serving requests if one application server stops responding. The team wants traffic to be sent to whichever healthy server is available. Which design should they implement?

A.A load balancer in front of multiple application servers
B.A RAID 1 array in the application server
C.A snapshot of the application server before each update
D.A longer password policy for the portal administrators
AnswerA

A load balancer sits in front of the application servers and continuously performs health checks (TCP or HTTP probes) against each node. When it detects a failed or unresponsive server, it stops sending new requests to that node and distributes the traffic among the remaining healthy servers. This provides automated failover and horizontal scaling, so the customer portal keeps serving requests even if one application instance goes down. At Layer 7, the load balancer can also inspect application responses, not just TCP connectivity, ensuring that servers with HTTP 500 errors are removed from rotation.

Why this answer

A load balancer distributes incoming traffic across multiple application servers and performs health checks (e.g., HTTP GET requests to a /health endpoint) to detect failures. If one server stops responding, the load balancer automatically routes requests only to the remaining healthy servers, ensuring continuous availability. This design directly meets the requirement for fault tolerance and active traffic distribution.

Exam trap

The trap here is that candidates confuse high availability (multiple servers with a load balancer) with data redundancy (RAID) or backup strategies (snapshots), thinking any form of redundancy solves the uptime requirement, but only a load balancer with health checks can actively reroute traffic away from a failed server.

How to eliminate wrong answers

Option B is wrong because RAID 1 (mirroring) provides disk-level redundancy for a single server, not application-level failover across multiple servers; it cannot route traffic away from a failed application server. Option C is wrong because a snapshot captures the state of a server at a point in time for backup or recovery, but it does not provide real-time traffic distribution or automatic failover when a server becomes unresponsive. Option D is wrong because a longer password policy improves authentication security for administrators but has no effect on server availability or traffic routing.

Practice this question →
54
MCQmedium

Based on the exhibit, what is the best next control to prevent noncompliant mobile devices from accessing corporate email while still allowing IT to wipe company data from lost phones?

A.Enforce conditional access so only compliant MDM-enrolled devices can reach email and enable selective wipe for corporate data.
B.Require users to set a longer password on the email app and keep the current access policy.
C.Disable email on all mobile devices and force users to use desktop computers only.
D.Rely on a remote full factory reset whenever a device is lost or reported stolen.
AnswerA

Conditional access stops noncompliant or compromised devices from using corporate email even if they have valid credentials. Selective wipe is especially important for BYOD because it removes work data without erasing personal content. Together, these controls support both access control and privacy, which is the correct architectural balance for the scenario.

Why this answer

It combines conditional access policies (e.g., Azure AD Conditional Access or Intune compliance policies) to block noncompliant devices from accessing corporate email, while using MDM selective wipe to remove only corporate data (e.g., email, documents) without affecting personal data on the device. This approach enforces security without requiring a full device wipe, preserving user privacy and IT control.

Exam trap

The trap here is that candidates often confuse full device wipe with selective wipe, assuming any remote wipe is acceptable, or they underestimate the importance of conditional access to enforce compliance before granting access.

How to eliminate wrong answers

Option B is wrong because requiring a longer password on the email app does not prevent noncompliant devices (e.g., jailbroken, missing patches) from accessing email, and it does not provide selective wipe capability. Option C is wrong because disabling email on all mobile devices is overly restrictive, reduces productivity, and fails to address the need for secure mobile access. Option D is wrong because a remote full factory reset wipes all personal data, violating user privacy and potentially causing data loss, whereas selective wipe targets only corporate data.

Practice this question →
55
Multi-Selectmedium

A security architect is evaluating a zero trust architecture (ZTA) for a remote workforce. Which three of the following components are essential to the implementation? (Choose three.)

Select 3 answers
.A policy engine that continuously evaluates trust based on user identity, device health, and context.
.A single, static firewall rule that allows all traffic from the corporate VPN IP range.
.Microsegmentation to limit lateral movement even after initial access is granted.
.A mandatory VPN for all remote users before accessing any resource.
.Encryption of all traffic, including internal east-west communications.
.Implicit trust for all devices that are connected to the internal network.

Why this answer

A policy engine is essential in zero trust architecture (ZTA) because it continuously evaluates trust based on user identity, device health, and context, dynamically granting or denying access. Microsegmentation is critical as it enforces granular access controls between workloads, preventing lateral movement even after an initial breach. Encrypting all traffic, including east-west communications, ensures data confidentiality and integrity across the network, aligning with the ZTA principle of never trusting and always verifying.

Exam trap

The SY0-701 exam often tests the misconception that a VPN is a core component of zero trust, but ZTA actually replaces VPNs with more granular, identity-based access controls that do not assume network-level trust.

Practice this question →
56
MCQmedium

A branch office has users, finance workstations, printers, and IP phones on one flat network. The security team wants to reduce lateral movement if one user PC is compromised, but printers still need to receive print jobs from users. What is the best design change?

A.Keep one flat network and increase endpoint antivirus scanning frequency.
B.Place finance systems and user devices in separate VLANs and allow only the necessary print and business application traffic through filtering rules.
C.Move all printers into the finance VLAN to avoid managing inter-VLAN rules.
D.Disable printing so user workstations cannot communicate with any other device.
AnswerB

This design reduces lateral movement by separating high-value systems from general user devices. VLANs create logical segmentation, and targeted filtering permits only the traffic required for printing and approved business flows. It preserves functionality while sharply reducing the number of systems reachable after a compromise.

Why this answer

Segmenting the flat network into separate VLANs for finance systems and user devices enforces network segmentation, which limits lateral movement. By using VLANs and firewall rules to allow only necessary traffic (e.g., print jobs via IPP or SMB, and business application traffic), the organization reduces the attack surface while maintaining required functionality. This aligns with the principle of least privilege and zero trust architecture.

Exam trap

The trap here is that candidates often choose Option C, mistakenly thinking that consolidating printers into the finance VLAN simplifies management, but they overlook that printers are notoriously insecure and would become a bridge for lateral movement into the finance segment.

How to eliminate wrong answers

Option A is wrong because increasing endpoint antivirus scanning frequency does not prevent lateral movement on a flat network; once a user PC is compromised, the attacker can still freely move to other devices (including finance workstations) on the same broadcast domain. Option C is wrong because moving all printers into the finance VLAN would expose printers to finance systems without proper isolation, and printers often have weak security (e.g., default credentials, unpatched firmware), creating a pivot point for attackers to reach finance assets; it also fails to address the need for inter-VLAN rules to allow user print jobs.

Practice this question →
57
MCQmedium

Based on the exhibit, which cloud deployment choice best satisfies the workload requirements? Exhibit: Workload requirements: - Processes regulated customer records - Should not share underlying compute with other tenants if avoidable - Team wants provider-managed hardware maintenance - Application will run in a public cloud Which deployment choice is the best fit?

A.Shared public tenancy on standard virtual machines.
B.Community cloud shared with other regulated organizations.
C.Public cloud with a dedicated host or equivalent single-tenant compute placement.
D.On-premises private cloud with company-owned servers and full hardware management.
AnswerC

This is the best match because it gives the organization stronger tenant isolation while still using provider-managed cloud infrastructure. A dedicated host or similar single-tenant placement reduces exposure to neighboring tenants and is well suited for regulated data without requiring the customer to buy and maintain physical servers. It balances security and operational convenience.

Why this answer

A dedicated host or single-tenant compute placement in a public cloud ensures the workload does not share underlying physical hardware with other tenants, meeting the 'should not share underlying compute' requirement. It also provides provider-managed hardware maintenance and runs in a public cloud, aligning with all stated workload requirements for processing regulated customer records.

Exam trap

The trap here is that candidates may confuse 'community cloud' (Option B) as meeting isolation needs, but it still involves multi-tenant compute sharing unless explicitly configured with dedicated hosts, which is not stated in the option.

How to eliminate wrong answers

Option A is wrong because shared public tenancy on standard virtual machines inherently shares the underlying physical server with other tenants, violating the requirement to avoid sharing compute if possible. Option B is wrong because a community cloud, while shared with other regulated organizations, still involves multi-tenant compute sharing and does not guarantee single-tenant isolation; it also may not offer provider-managed hardware maintenance in the same way as a public cloud dedicated host. Option D is wrong because an on-premises private cloud with company-owned servers requires the team to manage hardware maintenance themselves, contradicting the requirement for provider-managed hardware maintenance.

Practice this question →
58
Multi-Selecteasy

A company wants visibility into who changed settings in its cloud account and what commands ran on a cloud VM. Which two log sources should the team enable first? Select two.

Select 2 answers
A.Cloud provider audit or API logs
B.Guest operating system event logs
C.Printer spooler logs
D.Browser history from employees' home PCs
E.DHCP lease logs from the office router
AnswersA, B

Cloud provider audit or API logs (e.g., AWS CloudTrail, Azure Activity Log, Google Cloud Audit Logs) are the authoritative record of control-plane operations. Every API call that creates, modifies, or deletes a cloud resource is captured with the identity of the caller, source IP, timestamp, and request parameters. These logs are essential for determining exactly who changed security group rules, IAM policies, or other configuration settings, and they are tamper-evident by design when enabled with integrity validation or log file validation.

Why this answer

Cloud provider audit or API logs (Option A) capture all changes made to the cloud account via the provider's management plane, including who modified settings and when. Guest operating system event logs (Option B) record commands executed within the VM itself, such as PowerShell or bash commands, providing visibility into runtime activities. Together, these two sources cover both the control plane (account-level changes) and data plane (VM-level commands) for comprehensive monitoring.

Exam trap

The trap here is that candidates often confuse guest OS logs with hypervisor logs or assume cloud provider logs alone are sufficient, missing that VM-level command execution requires OS-level logging.

Practice this question →
59
Multi-Selecteasy

A company uses a SaaS email platform. The provider manages the servers and application code. Which two tasks remain the company's responsibility? Select two.

Select 2 answers
A.Configuring who can access company mailboxes and administrative roles.
B.Applying security patches to the provider's mail servers.
C.Deciding what data may be stored in the service and how it is classified.
D.Replacing failed provider storage disks.
E.Hardening the provider's hypervisor.
AnswersA, C

The provider manages the mail system infrastructure, but access control remains the customer's responsibility under the SaaS shared responsibility model. The company must create and manage user accounts, assign mailbox permissions, configure administrative roles, and enforce least privilege via role-based access control. This includes implementing conditional access policies, multi-factor authentication, and periodic access reviews to prevent privilege creep.

Why this answer

In a SaaS model, the customer retains administrative control over user access and role-based permissions. This includes configuring mailbox permissions, setting up multi-factor authentication, and managing administrative roles within the provider's interface. The provider handles the underlying infrastructure, but identity and access management (IAM) remains the customer's responsibility.

Exam trap

The SY0-701 exam often tests the misconception that 'patching' is always the customer's job, but in SaaS the provider handles all infrastructure patching, while the customer's responsibility is limited to configuration and data governance.

Practice this question →
60
MCQmedium

Based on the exhibit, what is the best security change to address the exposed management access on the cloud VM?

A.Ask the provider to patch the guest operating system on the VM.
B.Move SSH to a public IP on the VM so administrators can reach it more easily.
C.Restrict SSH through a bastion host or VPN and remove direct internet access to the VM.
D.Enable object storage versioning to protect the VM from unauthorized logins.
AnswerC

Restricting SSH through a bastion host or VPN eliminates the VM's direct internet exposure, forcing all management traffic to traverse a controlled, authenticated gateway. This reduces the attack surface by hiding the VM's SSH port from the public, adds logging and access control, and ensures only approved administrators with strong authentication can reach the management interface. It is the recommended security change for managing an IaaS VM.

Why this answer

Exposing SSH directly to the internet on a cloud VM creates a significant attack surface, allowing brute-force and credential-stuffing attacks. A bastion host (jump box) or VPN provides a controlled, authenticated entry point, while removing direct internet access to the VM ensures management traffic is isolated and audited. This aligns with the principle of defense in depth and the AWS/cloud best practice of using a bastion host for administrative access.

Exam trap

CompTIA often tests the misconception that patching (Option A) or moving the service to a public IP (Option B) solves exposure issues, when the real security flaw is the lack of network segmentation and a controlled access point like a bastion host or VPN.

How to eliminate wrong answers

Option A is wrong because patching the guest OS addresses software vulnerabilities but does not eliminate the exposed SSH management interface on the public internet; the core issue is network exposure, not missing patches. Option B is wrong because moving SSH to a public IP makes the management access even more exposed, increasing the attack surface and violating the principle of least privilege. Option D is wrong because object storage versioning is a data protection feature for recovering from accidental deletion or overwrite of objects; it has no relevance to securing VM management access or preventing unauthorized logins.

Practice this question →
61
MCQhard

An order-entry application must survive a single server failure and continue serving users if the primary site becomes unavailable. Management wants automatic failover, but does not want to pay for fully active production capacity in two regions. Which design is best?

A.Run one server and keep nightly backups in cloud object storage.
B.Use two servers in one site behind a load balancer and maintain an asynchronously replicated warm standby site.
C.Deploy active-active multi-region capacity with identical production load in both regions.
D.Add RAID 1 and a spare power supply to the database server.
AnswerB

This provides local redundancy for server failure and a lower-cost secondary site for failover if the primary site is lost.

Why this answer

It combines a load-balanced active-passive pair at the primary site with an asynchronously replicated warm standby at a secondary site. This design meets the requirement for automatic failover and continued service after a single server failure or primary site outage, while avoiding the cost of fully active multi-region capacity. Asynchronous replication ensures the standby site is ready to take over without requiring synchronous writes that would add latency or require identical production load.

Exam trap

The trap here is that candidates often confuse high availability (local redundancy) with disaster recovery (site-level failover), and incorrectly assume that RAID or backups alone satisfy the requirement for automatic failover after a site outage.

How to eliminate wrong answers

Option A is wrong because nightly backups in cloud object storage provide only point-in-time recovery, not automatic failover or near-continuous availability; a server failure would cause extended downtime while restoring from backup. Option C is wrong because active-active multi-region capacity with identical production load in both regions directly contradicts management's requirement to avoid paying for fully active production capacity in two regions. Option D is wrong because RAID 1 and a spare power supply protect only against local hardware failures (disk or power supply) within a single server, not against a server failure or a full site outage.

Practice this question →
62
MCQeasy

System administrators need to manage internal switches from home. The solution must encrypt management traffic, strongly authenticate users, and avoid exposing management ports directly to the internet. What should be used?

A.Telnet over port 23 with an allow list on the firewall.
B.A VPN into the internal network, then SSH or HTTPS for administration.
C.RDP directly to the switch management interface from the public IP address.
D.Open the management port to the internet and rely on a long password.
AnswerB

This is the best answer because it keeps management interfaces off the public internet while still allowing secure remote administration. The VPN provides encrypted transport and can enforce strong user authentication, and SSH or HTTPS protects the device management session itself. This layered approach matches common best practice for remote admin access and reduces exposure of sensitive management services.

Why this answer

A VPN creates an encrypted tunnel over the internet, protecting management traffic in transit. Once connected to the internal network, SSH (for CLI) or HTTPS (for web GUI) provides strong authentication and encryption for switch administration. This approach avoids exposing management ports directly to the internet, reducing the attack surface.

Exam trap

The trap here is that candidates may think Telnet with a firewall allow list is sufficient, overlooking that Telnet provides no encryption, or they may confuse RDP as a valid switch management protocol, when switches typically use SSH or HTTPS for administration.

How to eliminate wrong answers

Option A is wrong because Telnet transmits all data, including credentials, in cleartext (no encryption), violating the encryption requirement. Option C is wrong because RDP is designed for remote desktop access to workstations, not for switch management interfaces, and exposing it directly to the internet bypasses the requirement to avoid direct exposure. Option D is wrong because opening the management port to the internet violates the requirement to avoid direct exposure, and relying solely on a long password does not provide strong authentication (e.g., no multi-factor or certificate-based authentication) and leaves the system vulnerable to brute-force attacks.

Practice this question →
63
MCQmedium

A company's current remote access solution uses a traditional VPN that grants users full network-layer access to the internal LAN once authenticated. The security architect wants to adopt a zero trust architecture to reduce the risk of lateral movement by compromised endpoints. Which of the following implementations best aligns with zero trust principles?

A.Implement a next-generation firewall and require all remote traffic to pass through it with strict rules.
B.Deploy a secure web gateway and require all remote users to browse through a proxy.
C.Use a software-defined perimeter that authenticates each user and device before granting access only to specific applications.
D.Enable multi-factor authentication for VPN and implement a VPN concentrator with split tunneling.
AnswerC

A software-defined perimeter (SDP) or zero trust network access (ZTNA) solution authenticates and authorizes each connection request individually, creating an encrypted tunnel only to the requested application. This prevents lateral movement because the user never receives a network-level address on the internal LAN.

Why this answer

A software-defined perimeter (SDP) implements zero trust by authenticating both the user and device before granting access to specific applications, not the entire network. This prevents lateral movement by ensuring that even after authentication, the endpoint can only reach the allowed application, not the full LAN. This aligns with the zero trust principle of 'never trust, always verify' and micro-segmentation.

Exam trap

The trap here is that candidates often confuse 'stronger authentication' (MFA) or 'better firewalling' (NGFW) with zero trust, but zero trust requires eliminating implicit trust at the network layer by granting access only to specific applications, not the entire LAN.

Why the other options are wrong

A

A next-generation firewall with strict rules still provides network-layer access to the entire LAN after authentication, which does not prevent lateral movement by compromised endpoints. Zero trust requires per-request, least-privilege access to specific resources, not broad network access.

B

A secure web gateway (SWG) primarily filters web traffic and enforces policies for web-based applications, but it does not provide per-application, identity-aware access control for all remote resources. It still typically operates at the network layer and does not fully implement zero trust's principle of least privilege for individual applications.

D

Enabling MFA for VPN and using split tunneling still grants full network-layer access to the LAN after authentication, which violates zero trust's principle of least privilege and does not prevent lateral movement by compromised endpoints.

Practice this question →
64
Multi-Selecthard

A customer portal must stay online if an entire site fails, and the company must also be able to recover if data is corrupted or encrypted by ransomware. Which two design choices best satisfy both requirements? Select two.

Select 2 answers
A.Use active-active or automatic failover between two sites with health checks.
B.Keep only RAID 1 inside each server, because mirroring alone handles site outages.
C.Maintain immutable offsite backups and test restores on a regular schedule.
D.Store nightly backups on the same storage array as the production data.
E.Replace the load balancer with a static DNS record for each server.
AnswersA, C

A second site with automatic failover or active-active traffic handling preserves availability when one location goes offline. Health checks let the load balancer or orchestration layer stop sending traffic to a failed site quickly. This directly addresses the requirement to keep the portal online during a total site outage.

Why this answer

Active-active or automatic failover between two sites with health checks ensures that if an entire site fails, traffic is automatically redirected to the surviving site, maintaining availability. This design satisfies the first requirement of staying online during a site failure by using redundant infrastructure and health monitoring to detect and react to outages.

Exam trap

The trap here is that candidates often assume RAID or local backups provide sufficient protection against site outages and ransomware, but RAID only handles disk failure and same-site backups are vulnerable to the same ransomware attack, so both requirements demand geographically separate, immutable backups and multi-site failover.

Practice this question →
65
MCQeasy

Guest tablets in a conference room use the same physical switches as employee devices. The security team wants guests to have internet access only, with no route to internal subnets. Which design best meets the goal?

A.Keep guests on the same VLAN and rely on a separate Wi-Fi password.
B.Place guests on a separate VLAN and block internal access with ACLs.
C.Use stronger WPA3 encryption on the wireless network and leave the network flat.
D.Enable MAC address filtering on the switch and allow all ports to remain in the default network.
AnswerB

A VLAN segregates guest devices into a separate Layer 3 subnet, breaking their ability to directly reach internal hosts by IP at Layer 2. The ACLs applied on the router or Layer 3 switch then explicitly deny the guest subnet from accessing internal subnets, while still permitting the guests to reach the internet and necessary services like DHCP and DNS. This creates a defense-in-depth boundary that controls traffic based on network segments, rather than relying on the wireless encryption or address filtering, making it the correct and industry-standard approach.

Why this answer

Placing guest tablets on a separate VLAN segments traffic at Layer 2, and applying ACLs on the Layer 3 interface (SVI or router) blocks all routes to internal subnets while permitting internet access. This design ensures that even though guests share the same physical switches, their traffic is isolated from employee VLANs and cannot reach internal resources.

Exam trap

The trap here is that candidates confuse authentication/encryption methods (password, WPA3, MAC filtering) with network segmentation, failing to recognize that only Layer 2 VLAN separation combined with Layer 3 ACLs can enforce routing restrictions between subnets.

How to eliminate wrong answers

Option A is wrong because relying on a separate Wi-Fi password does not provide network segmentation; devices on the same VLAN can still communicate at Layer 2, and a guest could potentially discover and access internal hosts. Option C is wrong because stronger WPA3 encryption protects wireless traffic from eavesdropping but does not prevent a guest device from routing to internal subnets if the network is flat (no VLAN segmentation). Option D is wrong because MAC address filtering only controls which devices can connect to the switch port, but it does not restrict traffic between VLANs or subnets; leaving all ports in the default network allows guests to reach internal resources directly.

Practice this question →
66
MCQmedium

A company wants employees to sign in once to access several SaaS applications, but it also wants to require MFA only when users connect from unmanaged devices or outside the corporate network. Which architecture best supports this goal?

A.Create separate usernames and passwords for each SaaS application and disable browser-based token sharing.
B.Implement federated identity with single sign-on and conditional access policies tied to device posture and network location.
C.Use local accounts in each SaaS application and rotate passwords every 30 days.
D.Grant all employees the same access role to simplify authentication and reduce support tickets.
AnswerB

Federation lets the organization use one identity provider for multiple SaaS applications, which enables single sign-on. Conditional access then adds policy-based decisions such as requiring MFA for unmanaged devices or external access. This combination is both more secure and more user-friendly than separate credentials or blanket MFA for every sign-in.

Why this answer

Federated identity with single sign-on (SSO) allows users to authenticate once and access multiple SaaS applications, while conditional access policies evaluate device posture (e.g., compliance status, managed vs. unmanaged) and network location (e.g., corporate IP range vs. external) to enforce MFA only when risk conditions are met. This architecture leverages standards like SAML 2.0 or OpenID Connect for SSO and integrates with device management systems (e.g., MDM) to assess device health before granting access.

Exam trap

The trap here is that candidates often confuse 'federated identity' with simple password synchronization or think that SSO alone handles MFA, missing the critical role of conditional access policies that dynamically enforce MFA based on device and network context.

How to eliminate wrong answers

Option A is wrong because creating separate usernames and passwords for each SaaS application eliminates SSO, forcing users to sign in repeatedly, and disabling browser-based token sharing does not address MFA requirements based on device or network context. Option C is wrong because using local accounts in each SaaS application with 30-day password rotation increases administrative overhead, fails to provide SSO, and does not support conditional MFA enforcement tied to device posture or network location. Option D is wrong because granting all employees the same access role violates the principle of least privilege, does not enable SSO, and provides no mechanism to enforce MFA based on device or network conditions.

Practice this question →
67
MCQmedium

A small company is moving its public web app to a new network. The front-end server must be reachable from the internet, the application server should only accept traffic from the front end, and the database must never be reachable from the internet or user VLANs. Which design best meets these requirements with the least exposure?

A.Place all three servers in the same server VLAN and use host-based firewalls to separate them.
B.Place the web server in a DMZ, the application server in an internal subnet, and the database in a separate restricted subnet with firewall rules between each tier.
C.Place the database in the DMZ so the web and application servers can access it directly without extra firewall rules.
D.Place the web server on the user VLAN and use NAT to hide the database server from the internet.
AnswerB

This is the strongest design because each tier is isolated according to exposure. The web server is the only internet-facing system, the application tier only receives approved traffic from the web tier, and the database is protected behind internal filtering. That layout limits attack paths and supports least privilege between network zones.

Why this answer

It implements a classic three-tier architecture with network segmentation. The web server in the DMZ is isolated from internal networks but accessible from the internet, the application server in an internal subnet is protected by firewall rules that only allow traffic from the DMZ, and the database in a separate restricted subnet is further isolated with firewall rules that only permit traffic from the application server. This design minimizes exposure by enforcing least privilege and defense in depth, using network-layer segmentation rather than relying solely on host-based controls.

Exam trap

The trap here is that candidates may think host-based firewalls are sufficient for isolation (Option A) or that placing the database in the DMZ simplifies access (Option C), but the exam expects you to recognize that network segmentation with separate subnets and firewall rules is the most secure and least exposure approach for multi-tier applications.

How to eliminate wrong answers

Option A is wrong because placing all three servers in the same VLAN with host-based firewalls violates the principle of network segmentation; a single compromised host could pivot laterally to other servers within the same broadcast domain, and host-based firewalls are more easily misconfigured or bypassed than network-layer ACLs. Option C is wrong because placing the database in the DMZ directly exposes it to the internet, which contradicts the requirement that the database must never be reachable from the internet; this design also increases the attack surface by allowing the web and application servers to access the database without intermediate firewall enforcement.

Practice this question →
68
Multi-Selectmedium

An online retailer is redesigning a network for a public web app. Customers must reach only the web tier from the internet. The web tier must reach the application tier, and the application tier must reach the database tier. Which two design changes best support this zoning model? Select two.

Select 2 answers
A.Place all three server tiers on the same flat VLAN and rely on host firewalls.
B.Put the internet-facing web tier in a DMZ with tightly filtered inbound rules.
C.Give the database server a public IP address so the web tier can connect faster.
D.Place the application and database tiers in separate internal zones with firewall allow-lists between them.
E.Use a single NAT device for all servers and disable interserver filtering.
AnswersB, D

Placing the web tier in a DMZ creates a controlled buffer zone between the public internet and trusted internal networks, with stateful firewalls enforcing tightly scoped forward rules that allow only HTTP/HTTPS inbound and specific outbound calls to the application tier. This minimizes attack surface while isolating the web servers from direct access to databases or internal hosts, so a breach at the edge does not automatically expose backend services. The DMZ sits on its own subnetwork, making it the only segment with a public presence.

Why this answer

Placing the internet-facing web tier in a DMZ (demilitarized zone) with tightly filtered inbound rules ensures that external users can only reach the web servers, while the DMZ network isolates them from internal tiers. This aligns with the principle of defense in depth, where the DMZ acts as a buffer zone, and inbound rules (e.g., allowing only TCP/443 for HTTPS) minimize the attack surface. The web tier can then initiate outbound connections to the application tier through a firewall with specific allow-lists, maintaining strict segmentation.

Exam trap

The trap here is that candidates often confuse a flat VLAN with host firewalls as sufficient segmentation, not realizing that host firewalls can be disabled or bypassed once an attacker gains local access, whereas network-layer segmentation (e.g., DMZ and separate internal zones) provides a more robust security boundary that is harder to circumvent.

Practice this question →
69
MCQeasy

Employees sign in once to the company portal and then can access email, the ticketing system, and the HR site without logging in again. What is this called?

A.Single sign-on
B.Port forwarding
C.Tokenization
D.Network address translation
AnswerA

SSO centralizes authentication: the user authenticates once to an identity provider (IdP), which then issues a signed token or assertion (e.g., via SAML 2.0 or OpenID Connect) that multiple service providers trust. Because the IdP establishes a persistent session, subsequent portal resources or integrated applications accept the established trust without prompting for credentials again. This is exactly the behavior described: one initial login grants access across the company's integrated services.

Why this answer

Single sign-on (SSO) allows a user to authenticate once and gain access to multiple applications or systems without re-entering credentials. In this scenario, the company portal acts as the identity provider (IdP), and after initial authentication, it issues a token (e.g., SAML assertion or Kerberos ticket) that is accepted by the email, ticketing, and HR systems as proof of identity. This eliminates the need for repeated logins across these services.

Exam trap

The trap here is that candidates confuse single sign-on with tokenization, because both involve 'tokens,' but tokenization is a data protection method for sensitive data, not an authentication mechanism for accessing multiple applications.

How to eliminate wrong answers

Option B is wrong because port forwarding is a network address translation (NAT) technique that redirects traffic from one IP address and port to another, typically used to expose internal services to the internet, not to manage authentication across multiple applications. Option C is wrong because tokenization replaces sensitive data (like credit card numbers) with a non-sensitive placeholder (token) for security, but it does not provide a mechanism for authenticating a user once and accessing multiple systems. Option D is wrong because network address translation (NAT) modifies IP address information in packet headers to map private addresses to public ones, and has no role in authentication or session management across applications.

Practice this question →
70
MCQmedium

Network engineers need to manage switches in a data center from home. The solution must encrypt management traffic, strongly authenticate users, and avoid exposing management ports directly to the internet. Which approach is best?

A.Telnet to the switches over a router port-forward rule.
B.SSH directly to the switches from the internet using password-only authentication.
C.Use SNMPv2c with restricted source IP addresses.
D.Connect through a VPN to a bastion host, then use SSH to the switches.
AnswerD

This is the correct approach because it layers multiple security controls: the VPN establishes an encrypted tunnel and authenticates users before any traffic enters the data center network, effectively hiding the switch management interfaces from public visibility. The bastion host serves as a controlled jump point, ensuring that only authorized administrators can initiate SSH connections to the switches and providing a centralized point for logging, auditing, and additional authentication factors. Using SSH from the bastion to the switches guarantees encryption and integrity, and it allows key-based or multi-factor authentication, resulting in a robust, traceable, and secure management path.

Why this answer

It combines a VPN (which encrypts all traffic and provides strong authentication) with a bastion host (a hardened jump server) to avoid exposing switch management interfaces directly to the internet. SSH then provides encrypted, authenticated access to the switches from the bastion host, meeting all three requirements: encryption, strong authentication, and no direct internet exposure.

Exam trap

The trap here is that candidates often think SSH alone (Option B) is sufficient because it encrypts traffic, but they overlook the requirement to avoid exposing management ports directly to the internet, which is a critical security design principle tested in SY0-701.

How to eliminate wrong answers

Option A is wrong because Telnet transmits all data, including passwords, in cleartext (no encryption) and port-forwarding exposes the switch management port directly to the internet, violating the requirement to avoid direct exposure. Option B is wrong because SSH does provide encryption, but allowing direct SSH from the internet exposes the switch management port and password-only authentication is not considered strong authentication (lacks multi-factor or key-based methods). Option C is wrong because SNMPv2c uses community strings in cleartext (no encryption) and provides only weak authentication; restricting source IPs does not encrypt traffic or provide strong user authentication.

Practice this question →
71
Multi-Selectmedium

After a merger, dozens of laptops arrive with inconsistent settings and a history of unsupported utilities installed by the previous owner. The security team wants to establish a known-good configuration, reduce future drift, and accelerate remediation of newly discovered vulnerabilities. Which three actions best support that goal? Select three.

Select 3 answers
A.Build and deploy a secure baseline or gold image for the laptops.
B.Use centralized patch management with staged rollouts and reporting.
C.Enforce configuration management that reapplies approved settings after drift is detected.
D.Allow each user to customize local security settings for productivity.
E.Skip validation after patching because the baseline will always remain correct.
AnswersA, B, C

A secure baseline establishes the approved configuration for the fleet and gives the team a repeatable starting point. A gold image reduces configuration variation from device to device and makes it easier to verify what should be present. It is the most direct way to normalize inherited systems after a merger or acquisition.

Why this answer

A is correct because building and deploying a secure baseline or gold image ensures all laptops start from a known-good configuration, eliminating inconsistencies and unsupported utilities from the previous owner. This directly supports the goal of establishing a trusted state and provides a reference point for detecting future drift.

Exam trap

The trap here is that candidates may think user customization (Option D) is acceptable for productivity, but the scenario explicitly requires a known-good configuration and reduced drift, making any uncontrolled customization counterproductive.

Practice this question →
72
MCQmedium

A company wants all corporate laptops to authenticate to Wi-Fi using device certificates instead of shared passwords. It also wants to deny network access to systems that do not meet the baseline requirement for disk encryption and current endpoint protection. Which approach best satisfies both goals?

A.Use a single WPA2-Personal passphrase and email it to all employees.
B.Deploy 802.1X with certificate-based authentication and network access control posture checks.
C.Allow any device to join and rely on antivirus scans after users log in.
D.Use MAC address filtering and a captive portal for all internal Wi-Fi users.
AnswerB

802.1X using EAP-TLS or a similar certificate-based protocol provides mutual authentication: the corporate laptop presents a client certificate stored in its machine store, and the RADIUS/AAA server validates it against the CA, ensuring only authorized corporate devices connect. Network Access Control (NAC) posture checks then assess compliance criteria such as OS patch level, antivirus status, and disk encryption, automatically quarantining noncompliant devices until they are remediated.

Why this answer

802.1X with certificate-based authentication ensures that only devices with valid certificates can authenticate to the Wi-Fi network, eliminating reliance on shared passwords. Network access control (NAC) posture checks then evaluate each device against baseline requirements (e.g., disk encryption, current endpoint protection) and deny access to non-compliant systems. This combination directly satisfies both goals of certificate-only authentication and conditional access based on security posture.

Exam trap

The trap here is that candidates often confuse 802.1X with simple certificate authentication and overlook the NAC posture check component, assuming that certificate-based authentication alone meets the baseline requirement, but the question explicitly requires denying access to non-compliant systems, which only NAC can enforce.

How to eliminate wrong answers

Option A is wrong because WPA2-Personal uses a single shared passphrase, which does not enforce device-specific authentication or posture checks, and emailing the passphrase to all employees introduces a security risk. Option C is wrong because allowing any device to join and relying on post-login antivirus scans does not prevent non-compliant devices from accessing the network initially, violating the requirement to deny access to systems that do not meet baseline requirements. Option D is wrong because MAC address filtering can be spoofed and does not verify device certificates or security posture, and a captive portal typically only controls web access after connection, not the initial network authentication or compliance checks.

Practice this question →
73
MCQmedium

An online ticketing system must survive a single server failure and continue operating after a primary site outage. The business wants the lowest-cost design that still improves availability. Which architecture is best?

A.Deploy active-active servers across multiple regions with load balancing.
B.Use an active-passive design with replicated data and automatic failover to a secondary site.
C.Schedule nightly backups and restore only after the outage is confirmed.
D.Add RAID to the server to protect against all availability failures.
AnswerB

An active-passive design keeps a secondary site on standby with continuously replicated data (synchronous or asynchronous). When the primary server fails, automatic failover triggers the standby to become active, typically within seconds or minutes, and clients are redirected via a DNS change or virtual IP. This directly addresses a single server failure while limiting standby costs because the passive site runs at reduced capacity until needed.

Why this answer

An active-passive design with replicated data and automatic failover (Option B) meets the requirement of surviving a single server failure and a primary site outage while minimizing cost. Unlike active-active, it uses standby resources that only activate during failover, reducing operational expense. This architecture improves availability without the complexity and cost of multi-region active-active deployment.

Exam trap

The trap here is that candidates often choose active-active (Option A) because it offers the highest availability, but they overlook the explicit 'lowest-cost' constraint, which makes the cheaper active-passive design the correct answer despite its slightly longer failover time.

How to eliminate wrong answers

Option A is wrong because deploying active-active servers across multiple regions with load balancing provides high availability but at significantly higher cost due to redundant active infrastructure in multiple geographic locations, which exceeds the 'lowest-cost' requirement. Option C is wrong because nightly backups with restore only after outage confirmation does not provide continuous availability; it results in significant downtime (potentially hours or days) and data loss (up to 24 hours of transactions), failing the 'continue operating' requirement. Option D is wrong because RAID protects only against local disk failures, not against server failure (e.g., motherboard, power supply) or site outage (e.g., power loss, network cut), so it does not meet the survivability requirement.

Practice this question →
74
MCQmedium

A hospital is redesigning its wireless network. Guest devices must reach only the internet. Staff laptops need access to internal applications. Medical devices must communicate with a monitoring server but never with guest devices or the broader employee LAN. What design best meets these goals with the least operational complexity?

A.Place all devices on one flat network and rely on endpoint antivirus for protection.
B.Create separate VLANs for guest, staff, and medical devices, then enforce traffic rules between them with firewall policies.
C.Use a single wireless SSID with client isolation enabled and NAT all traffic through one gateway.
D.Deploy network access control only at login time and allow all devices onto the same internal subnet afterward.
AnswerB

This approach provides clean segmentation while keeping administration manageable. Separate VLANs define distinct trust zones, and firewall policies or ACLs control exactly which services can cross boundaries. That lets guest traffic stay internet-only, staff reach approved internal apps, and medical devices communicate only with the monitoring server.

Why this answer

VLANs logically segment the network into isolated broadcast domains for guest, staff, and medical devices, while firewall policies (e.g., using ACLs or stateful inspection) enforce granular traffic rules. This design ensures medical devices can only communicate with the monitoring server, guests are restricted to internet-only access, and staff can reach internal applications, all without requiring complex physical reconfiguration.

Exam trap

The trap here is that candidates may choose client isolation (Option C) thinking it provides security, but it breaks required device-to-server communication and does not enforce role-based access, whereas VLANs with firewall policies offer precise, scalable segmentation.

How to eliminate wrong answers

Option A is wrong because a flat network with only endpoint antivirus provides no network-level segmentation, allowing guest devices to potentially access staff or medical systems, violating isolation requirements. Option C is wrong because a single SSID with client isolation prevents all device-to-device communication, which would block legitimate traffic between medical devices and the monitoring server, and NAT alone does not enforce access controls between device groups. Option D is wrong because network access control only at login time (e.g., 802.1X authentication) does not enforce ongoing traffic restrictions; after authentication, all devices share the same subnet, allowing unauthorized communication between guest, staff, and medical devices.

Practice this question →
75
MCQmedium

An organization is redesigning its office network. Guest Wi-Fi must reach the internet only, employee laptops need access to internal apps, and a payment-processing system must be separated from general user traffic but still reach one database server. Which design best meets these requirements?

A.Place all devices on one flat network and rely on host firewalls for isolation.
B.Create separate VLANs or subnets for guest, user, and payment zones, then filter inter-zone traffic with firewalls or ACLs.
C.Put the payment system in a DMZ and allow direct internet access for database synchronization.
D.Use NAT on every endpoint so internal devices cannot be individually identified on the network.
AnswerB

This approach creates separate Layer 2 segments (VLANs or subnets) for guest, user, and payment zones, and then applies firewall or ACL rules between them. By enforcing least-privilege connectivity—allowing only the specific ports and protocols needed for business purposes—it prevents lateral movement from compromised guest or user devices into the payment environment. This is the standard segmentation practice required for compliance frameworks like PCI DSS.

Why this answer

It uses VLANs or subnets to segment guest, employee, and payment-processing traffic into separate broadcast domains, then applies firewall rules or ACLs to control inter-zone traffic. This allows guest Wi-Fi to be restricted to internet-only access, employee laptops to reach internal apps, and the payment system to communicate only with its specific database server while being isolated from general user traffic.

Exam trap

The trap here is that candidates often think a DMZ is always the correct answer for any sensitive system, but in this scenario, the payment system needs controlled access to an internal database, not internet exposure, making VLAN segmentation with firewalls the proper design.

How to eliminate wrong answers

Option A is wrong because a single flat network provides no segmentation; host firewalls alone cannot enforce network-level isolation between guest, employee, and payment traffic, leaving the payment system exposed to all other devices. Option C is wrong because placing the payment system in a DMZ with direct internet access for database synchronization violates the requirement to separate it from general user traffic and introduces unnecessary exposure to the internet, whereas the database should be accessed only via controlled internal paths. Option D is wrong because NAT on every endpoint does not provide network segmentation or access control; it only hides internal IP addresses, failing to isolate guest, employee, and payment traffic or restrict their communication paths.

Practice this question →
Page 1 of 3 · 182 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Security Architecture questions.

Start 20-question session