CCNA Security Architecture Questions — Page 2 of 3

MCQmedium

Based on the exhibit, which architecture best meets the goal of keeping the order service running if one application server fails?

A.Use one active server with a warm standby server that is started manually during outages.

B.Run the application servers active-active behind the load balancer.

C.Store the application binaries on RAID 1 disks to prevent service interruption.

D.Take nightly backups of the application servers and restore them after a failure.

AnswerB

This architecture keeps multiple application servers online simultaneously, with the load balancer distributing incoming requests and performing health checks. If one server fails, the load balancer stops sending traffic to it and the surviving servers continue handling the load, so service remains uninterrupted. This automatic failover and redundancy directly satisfies the goal of high availability.

Why this answer

An active-active architecture behind a load balancer ensures that if one application server fails, the load balancer automatically redirects traffic to the remaining healthy server(s). This provides high availability and fault tolerance without manual intervention, keeping the order service running continuously.

Exam trap

The trap here is that candidates often confuse data redundancy (RAID 1) with server-level fault tolerance, or they mistake backup strategies (nightly backups) for high-availability solutions, failing to recognize that only active-active or active-passive clustering with automatic failover meets the requirement of uninterrupted service during a server failure.

How to eliminate wrong answers

Option A is wrong because a warm standby server that is started manually introduces significant downtime (minutes to hours) while an administrator detects the failure and brings the standby online, failing the goal of keeping the service running during a failure. Option C is wrong because RAID 1 (mirroring) protects against disk failure but does not address application server failure; if the server itself crashes or its OS/application becomes unresponsive, the mirrored disks are still inaccessible. Option D is wrong because nightly backups are a disaster recovery measure, not a high-availability solution; restoring from backup can take hours and results in data loss from the last backup point, so the service would be interrupted for an extended period.

Practice this question →

MCQmedium

Based on the exhibit, what is the best cloud identity control to ensure terminated users lose access to the SaaS application quickly and consistently?

A.Keep the SaaS local user accounts and require the help desk to disable them manually after each termination.

B.Enable federated authentication with the corporate IdP and automate provisioning and deprovisioning with SCIM.

C.Create a shared emergency administrator account so access can be revoked by changing one password.

D.Require users to clear browser cookies after termination so the SaaS session expires sooner.

AnswerB

Federation centralizes authentication in the corporate identity provider, and SCIM automates account lifecycle changes based on HR events. That means terminations, transfers, and new hires can be reflected quickly in the SaaS application without relying on manual email tickets. This reduces orphaned accounts and improves consistency across the cloud environment.

Why this answer

Federated authentication with a corporate identity provider (IdP) combined with SCIM (System for Cross-domain Identity Management) ensures that when a user is terminated in the IdP (e.g., Active Directory or Azure AD), the SaaS application is automatically notified via SCIM to deprovision the user account. This eliminates manual intervention and guarantees consistent, near-instant revocation of access across all federated SaaS applications.

Exam trap

The trap here is that candidates often confuse session management (clearing cookies) with account deprovisioning, or they assume manual processes are acceptable for security, when the exam emphasizes automation and centralized identity management for consistency and speed.

How to eliminate wrong answers

Option A is wrong because keeping local SaaS accounts and manually disabling them via the help desk introduces human delay and inconsistency, violating the principle of automated, timely deprovisioning. Option C is wrong because a shared emergency administrator account does not address individual user termination; changing one password would affect all administrators, not just the terminated user, and violates non-repudiation and least privilege. Option D is wrong because clearing browser cookies only ends the current session on that specific browser; it does not revoke the user's underlying account or prevent re-authentication from other devices, and the user could simply log in again.

Practice this question →

MCQmedium

A development team wants to deploy a new internal application without managing operating system patching, runtime updates, or automatic scaling. The security team still wants the company to control the application code and its data access settings. Which cloud service model best fits this need?

A.Infrastructure as a Service, because the company can ignore guest OS patching entirely.

B.Platform as a Service, because the provider manages the platform and the company manages the application and data.

C.Software as a Service, because the team can deploy custom application code inside the vendor portal.

D.On-premises hosting, because the company can still use the provider's patching tools.

AnswerB

Platform as a Service (PaaS) provides a managed runtime environment where the provider automatically handles the underlying servers, operating system, runtime engine, and often scaling and patching, while the company retains control over the application source code, its configuration, and the data stored by the application. This division of responsibility lets the development team focus on building the internal app and stops them from manually maintaining the platform, making it the correct choice for the stated deployment goal.

Why this answer

Platform as a Service (PaaS) is the correct choice because the provider manages the underlying platform—including OS patching, runtime updates, and automatic scaling—while the company retains control over the application code and data access settings. This aligns with the shared responsibility model where the customer is responsible for the application and data, not the infrastructure.

Exam trap

The trap here is that candidates confuse PaaS with IaaS, assuming 'no patching' means IaaS, but IaaS still requires the customer to patch the guest OS and runtime, whereas PaaS fully offloads that responsibility.

How to eliminate wrong answers

Option A is wrong because Infrastructure as a Service (IaaS) requires the customer to manage guest OS patching and runtime updates, contradicting the team's desire to avoid those tasks. Option C is wrong because Software as a Service (SaaS) does not allow the customer to deploy custom application code; it only provides pre-built applications accessed via a vendor portal. Option D is wrong because on-premises hosting places full responsibility for patching and scaling on the company, not the provider, and does not eliminate the need for OS management.

Practice this question →

MCQmedium

A manufacturer needs to grant a partner company access to a procurement portal. Partner users should authenticate with their own identity provider, and the manufacturer does not want to create local passwords for each partner employee. Which design best supports this?

A.Create local accounts for every partner user and reset passwords manually when staff changes occur.

B.Share one VPN credential with the partner organization and let them manage access internally.

C.Use NTLM pass-through authentication to avoid setting up trust relationships.

D.Establish federation with SAML or OIDC and support just-in-time provisioning for partner users.

AnswerD

Federation with SAML or OIDC is the correct approach because it lets partner users authenticate against their own identity provider while the manufacturer's portal trusts the signed assertion and creates a local account on demand via just-in-time provisioning. This decouples identity lifecycle management from the manufacturer, reduces credential storage, and supports fine-grained authorization based on claims. It also enables seamless SSO, automatic account deactivation when the partner revokes access, and strong compliance through per-user auditable assertions.

Why this answer

Federation with SAML or OIDC allows the partner company to use its own identity provider for authentication, eliminating the need for local passwords. Just-in-time provisioning automatically creates user accounts in the manufacturer's procurement portal upon first successful authentication, ensuring access is granted without manual account management. This design supports secure cross-organization trust without sharing credentials or maintaining duplicate user stores.

Exam trap

The trap here is that candidates may confuse NTLM pass-through authentication (Option C) as a viable cross-org solution, not realizing it requires a direct Active Directory trust and cannot work without establishing a federation relationship, whereas federation with SAML/OIDC is the correct modern approach for external identity provider integration.

How to eliminate wrong answers

Option A is wrong because creating local accounts for every partner user and manually resetting passwords on staff changes is operationally unsustainable, violates the principle of least privilege, and introduces password management overhead that federation avoids. Option B is wrong because sharing one VPN credential violates the principle of non-repudiation and accountability, as it cannot distinguish individual users, and the partner cannot securely manage internal access without per-user authentication. Option C is wrong because NTLM pass-through authentication is a legacy Windows protocol that requires direct trust relationships between domains, does not support modern identity federation standards like SAML or OIDC, and is unsuitable for cross-organizational access without establishing a trust.

Practice this question →

Multi-Selecteasy

A company wants guest laptops on Wi-Fi to reach the internet but not internal printers or servers. Which two changes best support this design? Select two.

Select 2 answers

A.Assign guest access points to a separate VLAN with its own subnet.

B.Allow guests on the same VLAN as employee devices for simpler routing.

C.Use firewall rules to deny guest traffic to internal RFC1918 address ranges.

D.Enable WPA2-Enterprise on employee wireless only, and reuse that on guest devices.

E.Put printers on the guest VLAN so guests can print directly.

AnswersA, C

A separate VLAN and subnet keep guest devices logically isolated from corporate systems. This is a common first step in segmentation because it limits what guest traffic can reach and makes firewall policy easier to enforce.

Why this answer

Assigning guest access points to a separate VLAN with its own subnet isolates guest traffic at Layer 2, preventing direct communication with internal devices like printers and servers. This segmentation is a foundational step for enforcing access control policies without relying solely on higher-layer filtering.

Exam trap

The trap here is that candidates often think VLAN separation alone is sufficient, forgetting that a Layer 3 gateway (router/firewall) can still route between VLANs unless explicit ACLs or firewall rules block RFC1918 destinations.

Practice this question →

Multi-Selecteasy

A web application must be reachable from the internet, but its database should be isolated from direct internet access. Which two placements or controls are most appropriate? Select two.

Select 2 answers

A.Place the web server in a DMZ.

B.Keep the database on an internal network segment and restrict access to the web server only.

C.Place both the web server and the database on the same internet-facing subnet.

D.Expose the database port to the internet so administrators can connect faster.

E.Use the guest wireless VLAN for both systems.

AnswersA, B

A DMZ is a separate network segment that sits between the internet and the internal LAN. It is designed to host public-facing services like web servers, with firewall rules that allow inbound traffic only to the web server, while preventing direct access to internal resources. This containment limits compromise impact.

Why this answer

Placing the web server in a DMZ (Option A) allows it to be reachable from the internet while the internal firewall restricts inbound traffic to only necessary ports (e.g., TCP 80/443). Keeping the database on an internal network segment (Option B) and configuring firewall rules to allow traffic only from the web server’s IP address ensures the database is isolated from direct internet access, preventing external attacks on the database service.

Exam trap

The trap here is that candidates often think placing both systems in the DMZ is acceptable, but they overlook that the database must be on an internal segment with strict access controls, not just any segment with internet exposure.

Practice this question →

MCQeasy

An office wants finance workstations separated from general user PCs, but employees still need to print to a shared printer and access one accounting application. Which change best supports this?

A.Place all systems on one VLAN and rely on strong passwords.

B.Move finance systems to a separate VLAN or subnet and allow only required traffic through filtering rules.

C.Put the printer in a different building to make it more secure.

D.Enable screen lock timers on the finance PCs and keep the network flat.

AnswerB

This is the best choice because it separates finance systems from general users while still allowing approved services like printing and application access. VLANs or subnets reduce lateral movement, and firewall or ACL rules limit communication to only what is needed. That supports least privilege at the network layer.

Why this answer

Placing finance systems on a separate VLAN or subnet with a Layer 3 boundary enforces network segmentation, which limits broadcast domains and restricts lateral movement. By configuring access control lists (ACLs) or firewall rules to permit only the required traffic (e.g., SMB/CIFS for printer sharing and specific TCP/UDP ports for the accounting application), the organization achieves a least-privilege network architecture. This approach aligns with the principle of defense-in-depth, reducing the attack surface while maintaining necessary business functionality.

Exam trap

The trap here is that candidates often confuse physical separation (Option C) with logical network segmentation, or assume that strong passwords (Option A) or endpoint controls (Option D) are sufficient substitutes for network-layer isolation, when in fact VLANs and ACLs are required to enforce least-privilege access between different security zones.

How to eliminate wrong answers

Option A is wrong because placing all systems on one VLAN with strong passwords only provides authentication security but fails to segment traffic; a single VLAN allows any compromised general user PC to directly communicate with finance workstations via Layer 2, bypassing any network-level controls. Option C is wrong because moving the printer to a different building does not change the logical network topology—if the printer remains on the same flat network, it still exposes a shared resource without addressing segmentation, and physical relocation adds no security benefit against network-based attacks. Option D is wrong because enabling screen lock timers on finance PCs only addresses local physical access risks, while keeping the network flat (no VLANs or subnets) means all devices share the same broadcast domain, allowing potential attackers on general user PCs to perform ARP spoofing or sniff traffic destined for the printer or accounting application.

Practice this question →

MCQmedium

An enterprise is moving from on-prem identity to a SaaS HR platform. Employees should sign in with corporate credentials, and terminated users must lose access quickly without manually creating or deleting SaaS passwords. Which solution best fits?

A.Create a shared HR password for all employees and change it quarterly.

B.Use LDAP bind accounts directly against the SaaS platform for every login.

C.Implement federated SSO with the corporate identity provider and automated provisioning and deprovisioning.

D.Require each user to create a separate local SaaS account and store the credentials in a vault.

AnswerC

Federated SSO delegates authentication to the corporate identity provider, allowing users to sign in with existing enterprise credentials via standards like SAML or OIDC, while eliminating the need for separate SaaS passwords. Coupled with SCIM-based automated provisioning and deprovisioning, the platform's user accounts are created, updated, and removed synchronously with HR records, ensuring that departing employees lose access immediately. This architectural pattern enhances security, simplifies compliance, and reduces identity sprawl.

Why this answer

Federated SSO with the corporate identity provider (IdP) allows employees to sign in using their existing corporate credentials via standards like SAML 2.0 or OIDC, eliminating the need for separate SaaS passwords. Automated provisioning and deprovisioning (e.g., via SCIM) ensures that when a user is terminated in the HR platform, their access to the SaaS application is revoked immediately without manual intervention, meeting the requirement for rapid access removal.

Exam trap

The trap here is that candidates often confuse LDAP bind (Option B) with federated SSO, thinking that LDAP can directly authenticate against SaaS platforms, but LDAP is a directory access protocol that requires a gateway or federation service to work with cloud apps, and it lacks automated provisioning capabilities.

How to eliminate wrong answers

Option A is wrong because a shared HR password violates the principle of non-repudiation and individual accountability, and changing it quarterly does not provide immediate revocation of access for terminated users. Option B is wrong because LDAP bind accounts are designed for on-premises directory authentication and are not natively supported by most modern SaaS platforms; they would require a complex LDAP-to-SAML bridge and do not support automated deprovisioning. Option D is wrong because requiring each user to create a separate local SaaS account and store credentials in a vault introduces manual password management, contradicts the goal of using corporate credentials, and does not enable automated deprovisioning upon termination.

Practice this question →

MCQhard

A Linux operations team has a standing need to restart services and edit protected configuration files on production servers, but administrators should not keep root privileges all day. Every elevation must be approved through a ticket and logged centrally. Which solution best meets this requirement?

A.Create one shared root password and rotate it weekly

B.Use privileged access management with just-in-time elevation and session logging

C.Assign each administrator the server local administrator role permanently

D.Use single sign-on so administrators only authenticate once each morning

AnswerB

PAM with just-in-time elevation is the best match because it grants administrative rights only when needed and only after approval. Central session logging provides accountability, and the regular user account remains the default for normal work. This reduces standing privilege, limits misuse, and gives auditors a clear record of who elevated, when, and why.

Why this answer

Privileged Access Management (PAM) with just-in-time (JIT) elevation and session logging meets the requirement because it grants temporary, request-based root privileges that are automatically revoked after the task, and it centrally logs all commands executed during the elevated session. This ensures every elevation is approved via a ticket and auditable, without administrators retaining permanent root access.

Exam trap

The trap here is that candidates often confuse 'single sign-on' (SSO) with 'privilege elevation control,' assuming SSO's convenience implies security control, when in fact SSO only handles authentication, not authorization or session auditing.

How to eliminate wrong answers

Option A is wrong because a shared root password rotated weekly violates the principle of non-repudiation (no individual accountability) and does not enforce per-elevation approval or logging. Option C is wrong because permanently assigning the local administrator role (e.g., sudoers membership) gives continuous root-equivalent privileges, contradicting the requirement that administrators should not keep root privileges all day. Option D is wrong because single sign-on (SSO) only simplifies initial authentication; it does not control or log privilege elevation events, nor does it enforce ticket-based approval for each root action.

Practice this question →

MCQmedium

Several company laptops were found to boot from a removable drive containing an untrusted pre-boot utility before the operating system loaded. The security team wants to prevent unsigned or tampered boot code from starting. Which control is the best fit?

A.Enable Secure Boot in firmware and block external boot devices where possible.

B.Turn on screen lock after ten minutes of inactivity.

C.Increase the password complexity policy for user accounts.

D.Disable Windows Defender notifications on the endpoints.

AnswerA

Secure Boot checks boot components against trusted signatures before they are allowed to run, which directly addresses tampered or untrusted pre-boot code. Disabling external boot adds another layer by reducing the chance of unauthorized removable media being used to bypass protections.

Why this answer

Secure Boot is a UEFI firmware feature that verifies the digital signature of boot code against a trusted database before execution. By enabling Secure Boot and blocking external boot devices, the security team ensures that only signed, trusted bootloaders and drivers can run, preventing untrusted pre-boot utilities from loading. This directly addresses the scenario where laptops boot from a removable drive containing unsigned or tampered boot code.

Exam trap

The trap here is that candidates may confuse endpoint security controls (like screen lock or password policies) with boot-time integrity mechanisms, failing to recognize that Secure Boot is the only option that validates code before the OS loads.

How to eliminate wrong answers

Option B is wrong because screen lock after inactivity addresses unauthorized physical access to an already-booted OS, not the pre-boot execution of untrusted code. Option C is wrong because password complexity policies protect user account credentials but have no effect on boot-time code integrity or device boot order. Option D is wrong because disabling Windows Defender notifications only suppresses security alerts; it does not prevent unsigned boot code from executing.

Practice this question →

MCQeasy

A company wants guest Wi-Fi to reach only the internet, employee laptops to reach internal apps, and payment servers to remain isolated from both. What is the best design approach?

A.Place all systems on one flat network and rely on antivirus.

B.Use separate network segments with firewall rules between guest, employee, and payment zones.

C.Put all systems behind a single VPN so every device is treated the same.

D.Use a larger internet circuit so the payment servers are harder to attack.

AnswerB

This is the best choice because segmentation limits what each group can reach and reduces the impact of a compromise. Guest users are confined to internet access, employee systems can be limited to approved internal services, and payment servers can be placed in a tightly controlled zone with only required ports open. That design supports least privilege at the network layer and makes monitoring and containment easier.

Why this answer

Network segmentation using separate VLANs or subnets with firewall rules enforces isolation between guest Wi-Fi, employee laptops, and payment servers. This design ensures that guest traffic can only reach the internet, employee traffic can access internal apps, and payment servers are completely isolated from both, meeting the principle of least privilege and reducing the attack surface.

Exam trap

The trap here is that candidates may think a VPN provides isolation, but a VPN only encrypts traffic and does not inherently segment networks; without separate firewall rules, all VPN clients share the same network access.

How to eliminate wrong answers

Option A is wrong because placing all systems on one flat network with antivirus only provides endpoint protection and does not prevent lateral movement; an attacker on the guest Wi-Fi could directly access payment servers or internal apps. Option C is wrong because putting all systems behind a single VPN treats every device identically, removing the ability to enforce different access policies; it would allow guest devices to reach internal apps and payment servers, violating isolation requirements.

Practice this question →

MCQmedium

A payment processor stores full card numbers in its transaction database, but developers and analysts should never see the real numbers in nonproduction reports or troubleshooting tools. The business still needs to correlate the same card across multiple records. Which technique is the best fit?

A.Tokenization, because it replaces the real value with a surrogate token for business use.

B.Hashing, because the output can always be reversed by the application later.

C.Data masking, because it permanently deletes the sensitive record from the database.

D.Compression, because reducing file size also hides the payment information from users.

AnswerA

Tokenization replaces the real primary account number (PAN) with a randomly generated surrogate token that retains the same length and format, enabling the payment processor to perform transactions, lookups, and analytics without exposing the original card data. The actual PAN resides in a highly restricted token vault, so even if application databases or reports are compromised, the sensitive value remains secured.

Why this answer

Tokenization is the best fit because it replaces the full card number with a unique, non-reversible surrogate token that retains the ability to correlate records (the same card always produces the same token). This allows the business to perform analytics and troubleshooting without exposing the actual sensitive data, as the token has no mathematical relationship to the original PAN and cannot be reversed.

Exam trap

The trap here is that candidates confuse tokenization with hashing, assuming both are irreversible, but hashing is reversible for small input spaces like credit card numbers and does not provide a controlled surrogate for business correlation without exposing the original data.

How to eliminate wrong answers

Option B is wrong because hashing, while one-way, is deterministic and can be reversed via brute-force or rainbow tables if the input space is small (e.g., credit card numbers); it also does not provide a controlled surrogate for business use and may expose the original value if the hash is cracked. Option C is wrong because data masking dynamically obscures data (e.g., showing only last four digits) but does not permanently delete records; it still allows the real value to exist in the database and can be bypassed in nonproduction tools. Option D is wrong because compression reduces file size for storage or transmission but does not hide or protect sensitive data; the original card numbers remain fully visible after decompression.

Practice this question →

MCQeasy

An organization is placing its public-facing website behind a new security design. The site must be reachable from the internet, but the database and file servers must stay isolated from direct external access. What design should the architect use?

A.Place the web server on the internal user subnet so it can reach the database directly.

B.Create a demilitarized zone (DMZ) for the public web server.

C.Use a VPN concentrator so the website can be accessed securely from outside.

D.Use network address translation (NAT) on the web server to hide its IP address.

AnswerB

A demilitarized zone (DMZ) is a physically or logically isolated network segment that sits between the untrusted internet and the trusted internal network. It enforces firewall rules that allow only inbound traffic to the public web server while blocking direct access to internal hosts, ensuring that a breach of the web server does not automatically compromise internal systems.

Why this answer

A demilitarized zone (DMZ) is a network segment that isolates public-facing services, such as a web server, from the internal network. By placing the web server in the DMZ, the organization allows internet traffic to reach the website while keeping the database and file servers on the internal network, which are not directly accessible from the internet. This design enforces a security boundary where only necessary traffic (e.g., HTTP/HTTPS) is permitted through firewall rules, preventing direct external access to sensitive backend systems.

Exam trap

The trap here is that candidates often confuse NAT or VPN as security controls for isolation, when in fact they do not provide network segmentation; the DMZ is the only design that creates a physical or logical boundary to isolate public-facing servers from internal resources.

How to eliminate wrong answers

Option A is wrong because placing the web server on the internal user subnet would expose the internal network to direct internet traffic, violating the isolation requirement for the database and file servers. Option C is wrong because a VPN concentrator is designed for secure remote access by authenticated users, not for hosting a public website that must be reachable by anonymous internet clients. Option D is wrong because network address translation (NAT) on the web server only hides its IP address but does not isolate the database and file servers from direct external access; NAT alone provides no security boundary or segmentation.

Practice this question →

Drag & Dropmedium

Drag and drop the steps for the TLS 1.3 handshake process into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

TLS 1.3 reduces round trips; the client and server exchange key shares early, and the server's certificate is sent in the second flight.

Practice this question →

MCQmedium

Based on the exhibit, which data protection control best allows analysts to work with the records without exposing full card numbers?

A.Encrypt the entire analytics database and give the team the decryption key.

B.Tokenize the card numbers and keep the token mapping in a secured vault.

C.Hash the card numbers with SHA-256 so the analytics team can reverse them later if needed.

D.Delete all but the last four digits from the production database immediately.

AnswerB

Tokenization replaces sensitive card numbers with non-sensitive substitutes that can still support joins and repeated reporting without revealing the original values. Keeping the mapping in a secured vault protects the real numbers while allowing the analytics team to work with consistent placeholders. This fits the business need much better than simple encryption or masking alone.

Why this answer

Tokenization replaces sensitive card numbers with non-sensitive placeholders (tokens) that retain the format and length of the original data but have no exploitable value. The analytics team can work with the tokens for reporting and analysis, while the actual card numbers remain securely stored in a separate token vault, preventing exposure even if the analytics database is compromised.

Exam trap

CompTIA often tests the misconception that encryption is always the best data protection control, but the trap here is that encryption still exposes the data to anyone with the key, whereas tokenization removes the sensitive data from the working environment entirely, making it the correct choice for analytics without exposure.

How to eliminate wrong answers

Option A is wrong because encrypting the entire database and giving the team the decryption key would expose the full card numbers to anyone with the key, defeating the purpose of protecting the data during analysis. Option C is wrong because SHA-256 is a one-way hash function that cannot be reversed; the claim that the team can 'reverse them later' is technically impossible, and hashing does not preserve the format needed for analytics. Option D is wrong because deleting all but the last four digits from the production database is a destructive action that permanently loses data and does not allow the team to work with the full card numbers for any legitimate analysis that requires the complete value.

Practice this question →

MCQmedium

A customer portal must keep operating if one application server fails and also remain available if an entire site goes offline. Management is willing to pay more for automatic failover and the shortest possible interruption. Which design is best?

A.An active-active deployment across two sites with load balancing and replicated data.

B.A cold site that restores from nightly backups after a failure.

C.A single active site with one standby server in the same rack.

D.RAID 1 on the database server with no additional redundancy.

AnswerA

An active-active deployment across two sites uses load balancers to distribute traffic to both locations, with data continuously replicated between sites. If one site fails, the load balancer instantly shifts all traffic to the surviving site, and because both are actively serving, failover requires no startup time. This architecture achieves near-zero RPO and RTO, but demands careful session management (e.g., sticky sessions or distributed caching) and conflict resolution for replicated writes, adding complexity and cost.

Why this answer

An active-active deployment across two sites with load balancing and replicated data ensures continuous operation if one application server fails and also if an entire site goes offline. Load balancers distribute traffic to healthy servers, and synchronous data replication keeps both sites consistent, enabling automatic failover with minimal interruption. This design meets the requirement for the shortest possible interruption because failover is instantaneous and does not require manual intervention or data restoration.

Exam trap

The trap here is that candidates often confuse high availability within a single site (like a standby server in the same rack) with disaster recovery across sites, failing to recognize that site-level failures require geographic redundancy, not just server-level redundancy.

How to eliminate wrong answers

Option B is wrong because a cold site that restores from nightly backups after a failure introduces significant downtime (hours or days) for restoration and does not provide automatic failover or the shortest possible interruption. Option C is wrong because a single active site with one standby server in the same rack cannot survive an entire site outage, as both servers are in the same physical location and share the same site-level risks (e.g., power failure, natural disaster). Option D is wrong because RAID 1 on the database server provides only local disk redundancy within a single server, not application-level failover or site-level availability, and does not address server or site failures.

Practice this question →

MCQeasy

A manager can access the HR portal normally from a managed laptop, but if they sign in from an unmanaged tablet, the system should require extra verification before granting access. Which control best fits?

A.Conditional access based on device trust or risk.

B.A longer password expiration interval.

C.A separate VLAN for each manager.

D.Data encryption at rest on the HR database.

AnswerA

This is the best answer because conditional access can change authentication requirements depending on the device or sign-in context. A managed laptop can be allowed normally, while an unmanaged tablet can trigger extra verification such as MFA or access restrictions. That lets the organization balance usability and security instead of using the same rule for every login.

Why this answer

Conditional access policies evaluate device trust (e.g., compliance with security baselines, domain membership) and risk signals (e.g., location, sign-in behavior) to enforce step-up authentication. This directly matches the requirement: allow normal access from a managed laptop, but require extra verification from an unmanaged tablet. Other options like password expiration, VLAN segmentation, or encryption do not dynamically adjust authentication requirements based on device trust.

Exam trap

The trap here is that candidates often confuse data protection controls (encryption, VLANs) with access control mechanisms, failing to recognize that conditional access is the only option that dynamically adjusts authentication requirements based on device trust or risk.

How to eliminate wrong answers

Option B is wrong because a longer password expiration interval does not differentiate between managed and unmanaged devices; it applies uniformly to all users regardless of device trust. Option C is wrong because a separate VLAN for each manager provides network segmentation but does not enforce extra verification based on device trust or risk at the authentication layer. Option D is wrong because data encryption at rest protects stored data on the HR database but does not control access decisions or require additional authentication based on the device used to sign in.

Practice this question →

MCQmedium

A hospital has clinical workstations, badge readers, and building cameras all connected to the same switching infrastructure. After a workstation infection, the security team wants to prevent those endpoints from laterally reaching the badge readers while still allowing the cameras to report to a recording server. What should be implemented first?

A.Create separate VLANs and apply ACLs between device groups based on business need.

B.Increase the DHCP lease time so devices keep the same IP addresses longer.

C.Replace the switches with unmanaged models to simplify configuration.

D.Disable the cameras' encryption so the recording server can process traffic faster.

AnswerA

Separate VLANs establish different trust zones, and ACLs limit only the necessary traffic between them.

Why this answer

Creating separate VLANs segments the network into distinct broadcast domains, preventing workstations from directly reaching badge readers at Layer 2. Applying ACLs between VLANs then enforces granular access control, allowing only the cameras to communicate with the recording server while blocking lateral movement from infected endpoints. This aligns with the principle of least privilege and is the foundational step for network segmentation.

Exam trap

The trap here is that candidates often overlook the need for Layer 2 segmentation (VLANs) as a prerequisite for Layer 3/4 ACLs, mistakenly thinking ACLs alone on a flat network can block lateral movement between devices in the same subnet.

How to eliminate wrong answers

Option B is wrong because increasing DHCP lease time does not provide any security controls; it only reduces IP address churn and does not prevent lateral movement between devices. Option C is wrong because replacing managed switches with unmanaged models removes the ability to configure VLANs, ACLs, or any traffic filtering, making segmentation impossible. Option D is wrong because disabling encryption on cameras would expose video traffic to eavesdropping and does not address the need to restrict workstation-to-badge-reader access; it also violates security best practices.

Practice this question →

Multi-Selecthard

An operations team manages Linux servers over SSH. The security team wants to stop direct management access from employee laptops, reduce lateral movement if one admin endpoint is compromised, and keep a log of every administrative session. Which two design choices best fit? Select two.

Select 2 answers

A.Require administrators to connect to a bastion host or jump server before reaching the Linux servers.

B.Let all corporate laptops connect directly to SSH on the servers if MFA is enabled.

C.Restrict management interfaces so only the bastion host can reach them and log each session.

D.Expose SSH to the internet because key-based authentication is already strong.

E.Use split tunneling for admin traffic so management packets can bypass the VPN.

AnswersA, C

A bastion host is a hardened choke point for privileged access, so all administrative sessions can be concentrated, filtered, and monitored. It prevents direct SSH exposure from general user systems and gives the security team a single place to enforce logging and session control. This is a common hardened management-path pattern.

Why this answer

A bastion host (jump server) acts as a single, hardened entry point that administrators must connect to before reaching internal Linux servers. This eliminates direct SSH access from employee laptops, reducing the attack surface and preventing lateral movement if an admin endpoint is compromised. The bastion host can also enforce centralized logging of all administrative sessions, meeting the security team's requirement for session recording.

Exam trap

The trap here is that candidates often think MFA alone (Option B) is sufficient to secure direct access, but the question specifically requires reducing lateral movement and logging sessions, which only a bastion host with restricted access (Option A and C) can fully achieve.

Practice this question →

MCQeasy

A company runs a Linux virtual machine in an IaaS cloud service. The provider secures the physical datacenter and hypervisor. Which task remains the company's responsibility?

A.Patching the guest operating system on the virtual machine.

B.Replacing failed physical storage drives in the provider's data center.

C.Hardening the hypervisor that hosts the cloud tenant.

D.Controlling badge access to the cloud vendor's server room.

AnswerA

In an IaaS model, the organization still manages what runs inside the VM, including the guest operating system, patches, applications, and configuration. The cloud provider secures the underlying facility, hardware, and hypervisor, but it does not maintain the customer's OS or application stack. Keeping the guest OS patched is essential to reduce exposure to known vulnerabilities and aligns with the shared responsibility model.

Why this answer

In an IaaS cloud model, the provider is responsible for the physical infrastructure, including the datacenter, network, storage, and hypervisor. The customer retains responsibility for securing the guest operating system, including applying patches and updates. Patching the guest OS is a shared responsibility that falls squarely on the company operating the virtual machine.

Exam trap

The trap here is that candidates often confuse the shared responsibility model and assume the cloud provider handles all security tasks, including guest OS patching, when in fact the customer is responsible for anything above the hypervisor.

How to eliminate wrong answers

Option B is wrong because replacing failed physical storage drives is the responsibility of the cloud provider, who manages the underlying hardware in the datacenter. Option C is wrong because hardening the hypervisor is also the provider's responsibility, as the hypervisor is part of the virtualization layer that the customer does not have administrative access to.

Practice this question →

MCQmedium

A customer portal must keep operating if one application server fails. Management wants the simplest and lowest-cost design that still improves availability. What should the team implement?

A.Add more backups and schedule them every hour.

B.Use a second data center with synchronous replication and active-active clustering.

C.Deploy a hot standby application server with automatic failover.

D.Restart the failed server manually after the help desk is notified.

AnswerC

A hot standby provides a ready replacement if the primary application server fails, and automatic failover restores service without waiting for manual intervention. This design improves availability while staying simpler and less costly than a full active-active architecture across multiple sites. It matches the business need for continuity after one server failure without overengineering the solution.

Why this answer

A hot standby (active/passive) application server with automatic failover provides the simplest and lowest-cost improvement to availability. It eliminates the single point of failure by having a standby server ready to take over if the primary fails, without requiring complex load balancing or synchronous replication. This design directly addresses the requirement of keeping the portal operational during a single server failure while minimizing cost and complexity.

Exam trap

The trap here is that candidates often confuse high availability with disaster recovery, choosing synchronous replication and a second data center (Option B) when a simpler active/passive failover within the same site meets the requirement at lower cost.

How to eliminate wrong answers

Option A is wrong because increasing backup frequency does not improve availability; backups protect against data loss, not server failure, and the portal would still be unavailable until restored from backup. Option B is wrong because a second data center with synchronous replication and active-active clustering is significantly more complex and expensive, involving geographic redundancy, network latency management, and load balancing, which exceeds the 'simplest and lowest-cost' requirement.

Practice this question →

MCQmedium

A SaaS vendor supports both browser access and a mobile app. The company wants employees to sign in with corporate credentials, avoid separate passwords for each app, and use token-based authentication that works well with modern APIs. Which integration should the architect choose?

A.SAML federation to the SaaS vendor using browser assertions only.

B.OpenID Connect federation with the corporate identity provider.

C.LDAP bind authentication directly against each SaaS application.

D.Kerberos tickets issued directly by the SaaS vendor.

AnswerB

OpenID Connect (OIDC) is an identity layer built on OAuth 2.0 that returns a signed JWT ID token and an access token, enabling both user authentication and API authorization. It works natively across browsers via authorization code flow and mobile apps via PKCE, so it cleanly covers the SaaS vendor's dual access modes. Since OIDC federates with a corporate identity provider, users get seamless SSO while the mobile app securely obtains tokens without exposing passwords.

Why this answer

OpenID Connect (OIDC) is the correct choice because it is an identity layer built on top of OAuth 2.0, designed for token-based authentication that works seamlessly with modern REST APIs and mobile apps. It allows employees to sign in with corporate credentials via the corporate identity provider (IdP), eliminates separate app passwords, and issues ID tokens (JWT) and access tokens that the SaaS vendor can validate without browser redirects.

Exam trap

The trap here is that candidates often confuse SAML (which is browser-based) with OpenID Connect, assuming SAML can handle mobile apps and API tokens just as easily, but SAML lacks native support for token-based API authentication without complex extensions.

How to eliminate wrong answers

Option A is wrong because SAML federation using browser assertions only works well for web-based access but does not natively support mobile apps or token-based API authentication without additional extensions like SAML Bearer Assertion for OAuth 2.0, making it less suitable for modern API-driven scenarios. Option C is wrong because LDAP bind authentication requires direct network connectivity to the corporate directory, exposes credentials to each SaaS application, and does not provide token-based authentication or single sign-on across apps. Option D is wrong because Kerberos tickets are designed for on-premises Windows environments and require the SaaS vendor to be part of the same Kerberos realm, which is impractical for cloud-based SaaS; they also do not integrate with modern REST APIs or token-based flows.

Practice this question →

MCQmedium

Network engineers need to administer internal switches from home. The company wants encrypted management traffic, strong user verification, and no management ports exposed directly to the internet. Which approach is best?

A.Require a VPN or ZTNA connection with MFA, then allow SSH or HTTPS management only through that protected tunnel.

B.Expose SSH on the internet and rely on key-based authentication alone.

C.Use RDP with port forwarding because it is simpler for remote support.

D.Allow split tunneling without MFA so engineers can reduce latency while working remotely.

AnswerA

A VPN or ZTNA tunnel creates a cryptographically protected path from the engineer's workstation to the internal network, keeping SSH/HTTPS management virtual interfaces off the public internet where they can be targeted by scanners. Enforcing MFA at this boundary adds a strong identity check beyond just the device's own password or key, so a compromised credential alone isn't sufficient. This reduces the attack surface to a single hardened access point and ensures all administrative traffic for the switches traverses an encrypted, authenticated session.

Why this answer

It enforces encryption (via VPN or ZTNA tunnel), strong user verification (MFA), and network segmentation (no direct internet exposure). SSH or HTTPS management traffic is then allowed only through the protected tunnel, ensuring confidentiality, integrity, and access control. This aligns with the principle of defense in depth for remote network device administration.

Exam trap

The trap here is that candidates may think SSH key-based authentication alone is sufficient for remote access, overlooking the requirement to avoid direct internet exposure and the need for strong user verification like MFA.

How to eliminate wrong answers

Option B is wrong because exposing SSH directly to the internet violates the requirement of no management ports exposed to the internet, and key-based authentication alone does not provide strong user verification (e.g., no MFA). Option C is wrong because RDP is not designed for switch management (switches typically lack RDP support) and port forwarding still exposes the management port to the internet, violating the exposure restriction. Option D is wrong because split tunneling without MFA bypasses the encrypted tunnel requirement and weakens user verification, leaving management traffic potentially exposed and vulnerable to interception.

Practice this question →

MCQmedium

An organization is redesigning access for its HR portal. HR staff need to update employee records, managers need to approve leave requests, and payroll staff need access to salary data, but no single user should receive all of those permissions by default. What is the best access model?

A.Create separate roles for HR, managers, and payroll, and grant only the permissions needed for each job function.

B.Assign everyone the same portal permissions to simplify administration.

C.Give every manager full HR and payroll access so approvals are faster.

D.Use one shared administrator account for all HR actions to keep audits simple.

AnswerA

This is correct because it applies role-based access control (RBAC) and the principle of least privilege. By creating distinct roles for HR, managers, and payroll, each job function receives only the permissions required for its operational duties, preventing unnecessary access to sensitive records such as salary or disciplinary data. This role separation also enforces segregation of duties, so no single role can control an entire HR process, reducing the risk of fraud or accidental modification of critical records.

Why this answer

Role-Based Access Control (RBAC) assigns permissions based on job functions, ensuring that HR staff, managers, and payroll personnel receive only the privileges necessary for their roles. This enforces the principle of least privilege and prevents any single user from inheriting all permissions by default, which aligns with the organization's security requirement.

Exam trap

The trap here is that candidates may confuse RBAC with simpler models like DAC or MAC, or assume that convenience (e.g., faster approvals) justifies overriding least privilege, but the exam emphasizes that role separation and minimal permissions are mandatory for secure access design.

How to eliminate wrong answers

Option B is wrong because assigning everyone the same portal permissions violates the principle of least privilege, granting excessive access to users who do not need it and increasing the risk of unauthorized data exposure or modification. Option C is wrong because giving every manager full HR and payroll access bypasses role separation, allowing managers to view salary data and update employee records without need, which could lead to privilege escalation and compliance violations. Option D is wrong because using one shared administrator account eliminates accountability and audit trails, making it impossible to attribute actions to specific users and violating non-repudiation principles.

Practice this question →

100

MCQeasy

A help desk team wants guest Wi-Fi users to access only the internet and nothing on the internal corporate network. Which control should the network team implement at the wireless edge?

A.A single shared password for all guest users

B.An ACL or firewall rule set that blocks guest network access to internal subnets

C.A stronger DNS server

D.A longer Wi-Fi passphrase rotated monthly

AnswerB

An ACL or firewall rule set is the correct control because it operates at the network layer, where routing and reachability are decided. By placing guest traffic into a separate VLAN and applying rules on the guest default gateway or firewall, the help desk can permit internet-bound traffic while explicitly denying traffic destined to internal RFC 1918 subnets. This is exactly the kind of destination-based restriction that meets the requirement that guest users access only the internet.

Why this answer

To prevent guest Wi-Fi users from accessing the internal corporate network while allowing internet access, the network team must implement an ACL or firewall rule set at the wireless edge. This control explicitly blocks traffic from the guest VLAN/subnet to internal subnets (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) while permitting outbound traffic to the internet. This is a fundamental network segmentation technique that enforces the principle of least privilege at Layer 3/4.

Exam trap

The trap here is that candidates confuse authentication controls (passwords, passphrase rotation) with network access controls (ACLs, firewall rules), assuming that a strong password or DNS server can prevent lateral movement, when in fact only explicit Layer 3/4 filtering at the edge can enforce network segmentation.

How to eliminate wrong answers

Option A is wrong because a single shared password for all guest users does not restrict network access; it only provides authentication to the SSID, and without ACLs, guests could still reach internal resources. Option C is wrong because a stronger DNS server (e.g., using DNSSEC or a public resolver) does not block traffic to internal subnets; it only improves name resolution security and does not enforce network segmentation. Option D is wrong because a longer Wi-Fi passphrase rotated monthly improves authentication strength but does not control which networks a guest can reach once connected; it is a credential policy, not an access control mechanism.

Practice this question →

101

MCQeasy

A small company is publishing an internal website to the internet. The security team wants the web server reachable from the internet while keeping the database and file share isolated from direct internet access. Which design is best?

A.Place the web server and database on the same flat internal network behind the firewall.

B.Place the web server in a DMZ and keep the database and file share on a private internal subnet.

C.Place the database in the DMZ and keep the web server on the internal user VLAN.

D.Use a VPN for all users and keep every server on the same subnet.

AnswerB

This is the best design because the internet-facing system is isolated in a DMZ, while sensitive back-end systems stay off the public path. Traffic can be tightly filtered so only the required web-to-database communication is allowed. That reduces exposure if the web server is compromised.

Why this answer

It implements a DMZ architecture where the web server is placed in a publicly accessible network segment, while the database and file share reside on a private internal subnet. This design ensures that even if the web server is compromised, an attacker cannot directly access the internal resources because firewall rules restrict inbound traffic to only the DMZ and block any initiated connections from the DMZ to the internal network. This follows the principle of defense in depth and network segmentation as recommended by CompTIA for securing multi-tier applications.

Exam trap

The trap here is that candidates often confuse a DMZ as a place to put all servers that need internet access, but the correct design isolates only the front-end web server in the DMZ while keeping backend services like databases and file shares on a separate internal subnet to prevent direct exposure.

How to eliminate wrong answers

Option A is wrong because placing the web server and database on the same flat internal network behind the firewall exposes the database to direct internet traffic if the web server is compromised, violating the principle of least privilege and network segmentation. Option C is wrong because placing the database in the DMZ exposes it directly to the internet, which defeats the purpose of isolating sensitive data; the web server should be the only component reachable from the internet, with the database kept on a private subnet. Option D is wrong because using a VPN for all users and keeping every server on the same subnet eliminates network segmentation entirely, meaning that if any server is breached, all resources including the database and file share are immediately accessible, and VPN access does not prevent lateral movement within the same subnet.

Practice this question →

102

MCQmedium

A company wants to stop employees from running unauthorized tools downloaded from the internet on managed Windows laptops, but still allow approved internal apps and vendor-updated software. Which control is best?

A.Application control using an allowlist for approved executables and publishers.

B.Full-disk encryption on every laptop before deployment.

C.A stronger screen-lock timeout and automatic logoff policy.

D.A firmware password for the BIOS without any other endpoint restrictions.

AnswerA

Application control via an allowlist is a default-deny security control that only permits executables and publishers explicitly approved by the organization. It blocks unauthorized tools by verifying cryptographic hashes, publisher signatures, or full path rules before execution. This directly prevents users from running unapproved software, even if the user downloads it, because the endpoint refuses to launch anything not on the list.

Why this answer

Application control with an allowlist (also known as whitelisting) is the correct choice because it explicitly defines which executables, scripts, and publishers are permitted to run on managed Windows laptops. This prevents unauthorized tools downloaded from the internet from executing, while allowing approved internal apps and vendor-updated software that match the allowlist criteria. Technologies like Windows Defender Application Control (WDAC) or AppLocker enforce this by checking file hashes, publisher signatures, or path rules at runtime.

Exam trap

The trap here is that candidates often confuse data-at-rest protection (encryption) or session management (screen lock) with application execution control, mistakenly thinking they can prevent unauthorized software from running, when in fact they address entirely different security domains.

How to eliminate wrong answers

Option B is wrong because full-disk encryption (e.g., BitLocker) protects data at rest from unauthorized access if the laptop is lost or stolen, but it does not control which applications can run on the device; it has no mechanism to block execution of unauthorized tools. Option C is wrong because a stronger screen-lock timeout and automatic logoff policy addresses session security and unauthorized physical access, but it does not prevent a user from running downloaded executables while logged in; it has no application execution control capability.

Practice this question →

103

MCQmedium

A company is redesigning a customer portal. Internet users must reach only the web tier, the application tier must be reachable only from the web tier, and the database must be reachable only from the application tier. Administrators should manage servers from a dedicated jump host. Which design best meets these requirements?

A.Place all servers on one VLAN and use host firewalls on each system.

B.Place web servers in a DMZ, application servers in an internal server subnet, databases in a restricted trust zone, and allow administration only through ACLs from a jump host.

C.Place the database servers in the DMZ so the web tier can query them directly from the internet-facing network.

D.Use NAT for all servers and keep every system on the same internal subnet to simplify routing.

AnswerB

This design separates the exposure of each tier and limits traffic to the minimum necessary paths. The web servers can face the internet in a DMZ, while the application and database tiers remain progressively more restricted. ACLs and a jump host also enforce controlled administrative access and reduce direct management exposure.

Why this answer

Ly implements a layered security architecture by placing web servers in a DMZ (accessible from the internet), application servers in an internal subnet (accessible only from the DMZ), and databases in a restricted trust zone (accessible only from the application tier). Administration is restricted to a dedicated jump host, enforcing strict network segmentation and least-privilege access control via ACLs.

Exam trap

The trap here is that candidates may think host firewalls alone are sufficient for segmentation, ignoring that VLANs and network ACLs are required to prevent lateral movement and enforce tier-to-tier access restrictions at the network layer.

How to eliminate wrong answers

Option A is wrong because placing all servers on a single VLAN with host firewalls violates the requirement for network segmentation; host firewalls can be misconfigured or bypassed, and a single VLAN allows lateral movement between tiers if any host is compromised. Option C is wrong because placing database servers in the DMZ exposes them directly to the internet, contradicting the requirement that the database be reachable only from the application tier and creating a severe security risk.

Practice this question →

104

MCQeasy

A help desk team wants users to be unable to install unsanctioned browser extensions or freeware on corporate Windows laptops, while approved business apps still run. Which endpoint control is best?

A.Full-disk encryption on every laptop.

B.Application allowlisting or application control.

C.A remote access VPN.

D.A desktop wallpaper policy.

AnswerB

This is the best choice because allowlisting permits only approved software and blocks unapproved tools, extensions, and installers. It is a strong way to reduce malware risk and limit user-driven software sprawl. Approved business applications can still run because they are explicitly allowed, which preserves usability while enforcing a controlled endpoint environment.

Why this answer

Application allowlisting (or application control) is the correct endpoint control because it explicitly defines which software executables, scripts, and installers are permitted to run on the system. By default, all unapproved applications—including unsanctioned browser extensions and freeware—are blocked, while approved business apps are allowed to execute. This directly addresses the requirement to prevent unauthorized installations while maintaining normal operations for sanctioned software.

Exam trap

The trap here is that candidates often confuse data protection controls (like encryption) or network controls (like VPN) with application execution controls, failing to recognize that only allowlisting directly governs what software can run on the endpoint.

How to eliminate wrong answers

Option A is wrong because full-disk encryption protects data at rest from unauthorized access if the laptop is lost or stolen, but it does not control which applications or extensions a user can install or run. Option C is wrong because a remote access VPN secures network communications between the laptop and corporate resources, but it has no ability to block local software installations or enforce application policies. Option D is wrong because a desktop wallpaper policy is a visual configuration setting that cannot enforce any security controls over application execution or installation.

Practice this question →

105

MCQmedium

A team deploys an e-commerce application on an IaaS virtual machine. The cloud provider secures the datacenter, hardware, and hypervisor. The company wants to reduce the chance that attackers exploit outdated software on the VM itself. Which responsibility remains with the company?

A.Replace the cloud provider’s physical security controls with on-site guards.

B.Patch and harden the guest operating system and application running on the VM.

C.Install new firmware on the physical host server maintained by the provider.

D.Set the data center’s perimeter access badge policy.

AnswerB

In IaaS, the organization is responsible for the guest OS and everything above it, including applications and configuration. If attackers may exploit outdated software on the VM, the company must handle patching, hardening, and secure configuration of that environment.

Why this answer

In an IaaS model, the cloud provider is responsible for the security of the cloud (datacenter, hardware, hypervisor), while the customer is responsible for security in the cloud. This includes patching and hardening the guest OS and application on the VM. The company must manage vulnerabilities in the software stack it controls to prevent exploitation of outdated components.

Exam trap

The trap here is confusing the shared responsibility model: candidates often assume the provider handles all security (including OS patching) because they secure the hypervisor, but in IaaS, the customer retains full responsibility for the guest OS and applications.

How to eliminate wrong answers

Option A is wrong because physical security controls (e.g., on-site guards) are the provider's responsibility under the shared responsibility model; the company cannot replace them. Option C is wrong because firmware updates for the physical host server are the provider's responsibility, not the customer's, as the customer has no access to the hypervisor or host hardware. Option D is wrong because setting data center perimeter access badge policies is a physical security task owned by the provider, not the company using the IaaS VM.

Practice this question →

106

MCQmedium

Based on the exhibit, which capability should be added so the SaaS app automatically creates, updates, and disables user accounts as directory changes occur?

A.Require MFA on the SaaS login page and leave account provisioning manual.

B.Add SCIM provisioning between the directory and the SaaS application.

C.Change the password rotation interval to every 30 days for all users.

D.Store credentials in a shared spreadsheet so the help desk can disable access faster.

AnswerB

SCIM (System for Cross-domain Identity Management) is a RESTful API standard that automatically exchanges user identity attributes between an identity provider and cloud apps. When an admin changes a user's status in the directory, SCIM pushes that event to the SaaS application, creating, updating, or deactivating the account in near real time. This eliminates the window during which terminated employees retain access and removes the need for manual provisioning. It directly satisfies the requirement for automated identity lifecycle synchronization.

Why this answer

SCIM (System for Cross-domain Identity Management) is the standard protocol designed to automate user provisioning and deprovisioning between an identity provider (like a directory) and a service provider (like a SaaS app). By adding SCIM provisioning, the SaaS app can automatically create, update, and disable user accounts in response to changes in the directory, eliminating the need for manual account management.

Exam trap

The trap here is that candidates may confuse authentication mechanisms (like MFA) or password policies with identity lifecycle management, failing to recognize that SCIM is the specific protocol designed for automated provisioning and deprovisioning.

How to eliminate wrong answers

Option A is wrong because requiring MFA only adds an authentication layer and does not automate account lifecycle management; manual provisioning remains, which does not address the requirement. Option C is wrong because changing the password rotation interval to 30 days is a password policy change that does not automate the creation, update, or disabling of user accounts based on directory changes. Option D is wrong because storing credentials in a shared spreadsheet introduces security risks and does not provide automated provisioning; it only offers a manual, insecure method for disabling access.

Practice this question →

107

MCQhard

An online retailer is moving its public web app, internal API, and database into separate zones. Public users must reach only the web tier. The web tier must contact the app tier, and only the app tier may query the database. Admins should manage all servers from a hardened jump host. Which design best meets these goals and minimizes lateral movement?

A.Place all servers in one VLAN and rely on host-based firewalls to block unwanted traffic.

B.Create separate DMZ, application, and database zones with default-deny east-west rules and use a jump host for administration.

C.Put the database in the DMZ so the web tier can connect to it without extra firewall rules.

D.Expose the application tier to the Internet and use NAT to hide the database subnet.

AnswerB

Placing web, application, and database appliances into separate security zones with default-deny east-west rules enforces a least-privilege network. The DMZ only exposes the public-facing web tier; the application zone is not directly reachable from the Internet, and the database zone accepts connections solely from the application subnet. A jump host (bastion) centralizes administrative access from a hardened, auditable entry point, preventing direct management of sensitive tiers from unsecured networks. This tiered design contains a successful web-server compromise, as later moves to the application or database zones are blocked unless explicitly allowlisted.

Why this answer

It implements a multi-tier network architecture with separate DMZ, application, and database zones, enforcing default-deny east-west traffic rules. This ensures that public users can only reach the web tier, the web tier can only communicate with the app tier, and only the app tier can query the database, while all administrative access is funneled through a hardened jump host, which minimizes lateral movement by restricting inter-zone traffic to only what is explicitly required.

Exam trap

The trap here is that candidates often assume placing the database in the DMZ simplifies connectivity, but this violates the principle of defense in depth by removing network segmentation between the web tier and sensitive data storage.

How to eliminate wrong answers

Option A is wrong because placing all servers in one VLAN with host-based firewalls does not provide network-level segmentation; a compromised host could still potentially bypass host firewalls or exploit misconfigurations, allowing lateral movement across all tiers. Option C is wrong because putting the database in the DMZ exposes it to the same network segment as the web tier, violating the principle of least privilege and increasing the attack surface, as the database should never be directly accessible from the DMZ. Option D is wrong because exposing the application tier to the Internet directly exposes internal logic and APIs to potential attacks, and NAT alone does not enforce access control between tiers, leaving the database vulnerable to lateral movement if the app tier is compromised.

Practice this question →

108

MCQmedium

A team runs a confidential document repository on an IaaS virtual machine. The cloud provider secures the datacenter, hardware, and hypervisor. Which task remains the organization’s responsibility?

A.Patching the physical hosts inside the cloud provider's datacenter.

B.Replacing the provider's hypervisor when a new version is released.

C.Hardening the guest operating system and controlling access to the repository application.

D.Managing the cloud provider's physical badge access for the server room.

AnswerC

In IaaS, the organization is responsible for what it deploys on the virtual machine, including the guest operating system, its configuration, patching, and application-level access controls. Those tasks directly affect who can use the document repository and how securely the workload runs. Shared responsibility means the provider handles the platform, while the customer secures the OS and data-layer usage.

Why this answer

In an IaaS model, the cloud provider is responsible for the security of the cloud (physical datacenter, hardware, hypervisor), while the customer is responsible for security in the cloud. This includes hardening the guest OS, configuring firewalls, managing access controls, and patching the operating system and applications. Option C correctly identifies the organization's duty to secure the guest OS and the repository application.

Exam trap

The trap here is confusing the IaaS shared responsibility model with PaaS or SaaS, where the provider handles more of the stack; candidates often assume the provider patches the guest OS or manages application access, but in IaaS those are customer responsibilities.

How to eliminate wrong answers

Option A is wrong because patching physical hosts is the cloud provider's responsibility under the shared responsibility model; the customer has no access to the physical infrastructure. Option B is wrong because replacing the hypervisor is a provider-managed task; the customer only interacts with the virtual machine and its guest OS. Option D is wrong because managing physical badge access to the server room is a physical security control that falls entirely on the cloud provider, not the customer.

Practice this question →

109

MCQmedium

Sales staff use company laptops on public Wi-Fi and travel frequently. The company wants the disk contents unreadable if a laptop is stolen, even if the drive is removed and placed in another system. Which control is the best fit?

A.Require a screen lock after five minutes of inactivity.

B.Enable full-disk encryption with a hardware-backed key store such as a TPM, preferably with a pre-boot PIN.

C.Encrypt only the most sensitive folders with file-level encryption.

D.Rely on remote wipe because the device will usually connect to the internet again.

AnswerB

Full-disk encryption with a TPM-backed key store ensures the disk's encryption key is sealed to the device's firmware state, and adding a pre-boot PIN requires something you know in addition to the hardware. Without the PIN, the TPM won't release the key, so the drive cannot be decrypted even if it's removed and mounted elsewhere. This protects all data at rest, including OS files, and is the strongest practical defense when a device might fall into a thief's hands on the road.

Why this answer

Full-disk encryption (FDE) with a hardware-backed key store like a TPM ensures that the entire disk contents are encrypted at rest. Even if the drive is removed and placed in another system, the decryption key remains bound to the original TPM, and a pre-boot PIN adds an additional authentication factor, making the data unreadable without both the TPM and the correct PIN.

Exam trap

The trap here is that candidates often choose remote wipe (Option D) because it sounds proactive, but they overlook the critical requirement that the device must be online for remote wipe to work, which is not guaranteed for a stolen laptop that may never connect to the internet.

How to eliminate wrong answers

Option A is wrong because a screen lock after five minutes of inactivity only protects the device while it is locked; it does not encrypt the disk, so if the drive is removed and placed in another system, the data is fully readable. Option C is wrong because file-level encryption only protects specific folders, leaving other areas of the disk (e.g., system files, temp files, and unencrypted user data) exposed when the drive is removed. Option D is wrong because remote wipe relies on the device connecting to the internet; if the laptop is stolen and never reconnects, or if the thief immediately removes the drive, the wipe command cannot execute, leaving the data accessible.

Practice this question →

110

Multi-Selecthard

An organization stores full payment card numbers, analysts need the last four digits for investigation, and the backup team is worried about ransomware and stolen backup media. Which three controls best address these requirements? Select three.

Select 3 answers

A.Tokenize primary account numbers before they reach analytics, reporting, or test systems.

B.Store backups on the same production storage array to simplify restore operations.

C.Encrypt backup sets with keys managed outside the backup repository itself.

D.Use simple masking only in spreadsheets while leaving the source database unchanged.

E.Keep one immutable or air-gapped backup copy to resist ransomware and theft.

AnswersA, C, E

Tokenization replaces sensitive values with nonusable substitutes while preserving business usefulness for many workflows. Analysts can still correlate records, but exposed reports and test data no longer reveal the true card number. This is especially valuable for payment data because it reduces the number of environments that ever handle the actual secret value.

Why this answer

Tokenization replaces the full primary account number (PAN) with a unique token that retains the last four digits for analytics, so analysts can perform investigations without exposing sensitive cardholder data. This directly satisfies PCI DSS requirements for minimizing the use of full PANs in non-production environments, while preserving the utility needed for fraud analysis or reporting.

Exam trap

The trap here is that candidates often confuse tokenization with masking or encryption, assuming any obfuscation technique is sufficient, but tokenization is the only option that irreversibly removes the full PAN from analytics systems while preserving the last four digits for investigation.

Practice this question →

111

MCQeasy

An HR assistant should be able to view employee records, but should not have access to payroll administration or IT server tools. Which access model is best for assigning permissions by job role?

A.Role-based access control

B.Shared local administrator accounts

C.Open access for all employees

D.Biometric authentication

AnswerA

Role-based access control (RBAC) maps permissions to defined job functions rather than to individual identities, so an HR assistant receives exactly the permissions needed for HR tasks—viewing employee records—without elevation to unrelated administrative rights. In NIST's RBAC model, users are assigned to roles, roles have permissions on objects, and session constraints can enforce least privilege dynamically. This aligns with the principle of least privilege and scales cleanly as personnel changes, making it the appropriate access control model for an HR assistant role.

Why this answer

Role-based access control (RBAC) is the correct model because it assigns permissions based on job functions rather than individual users. In this scenario, the HR assistant role would be granted read/write access to employee records, while being explicitly denied access to payroll administration and IT server tools, ensuring least privilege and separation of duties. RBAC simplifies administration by grouping permissions into roles, which can be easily assigned or revoked as job responsibilities change.

Exam trap

The trap here is that candidates confuse authentication (biometrics) with authorization (access control), or assume that shared accounts or open access can be secured by policy alone, ignoring the fundamental need for role-based permission segregation.

How to eliminate wrong answers

Option B is wrong because shared local administrator accounts provide unrestricted, non-repudiable access to all system resources, which violates the principle of least privilege and would grant the HR assistant full control over payroll and IT tools. Option C is wrong because open access for all employees would allow every user, including the HR assistant, to view and modify payroll and IT server data, directly contradicting the requirement to restrict access. Option D is wrong because biometric authentication is an identity verification method (something you are), not an authorization model; it controls who logs in, not what permissions they have after authentication.

Practice this question →

112

MCQhard

A Windows file server was built from a gold image, but six months later a scan shows Remote Desktop enabled, SMBv1 re-enabled, and Print Spooler running. The same drift appears on several other servers after emergency troubleshooting. Security wants to return the environment to the approved baseline and prevent the changes from coming back. What is the best solution?

A.Document the deviations and rely on manual checks after each maintenance window

B.Deploy configuration management that enforces the hardened baseline continuously

C.Run a vulnerability scan more often and close the findings in the ticketing system

D.Increase storage capacity so the image can be rebuilt faster next time

AnswerB

Continuous configuration management is the best answer because it can reapply the approved baseline and correct drift across many systems automatically. This approach does more than detect the problem; it helps prevent the same insecure settings from persisting after troubleshooting or emergency changes. It is the most effective way to standardize hardening at scale and keep the environment aligned to policy.

Why this answer

Configuration management tools like Ansible, DSC, or Group Policy can continuously enforce a hardened baseline by reverting unauthorized changes (e.g., disabling SMBv1, stopping Print Spooler, disabling RDP) at a defined interval or on a trigger. This prevents configuration drift without relying on manual intervention or reactive scanning, directly addressing the root cause of the problem.

Exam trap

The trap here is that candidates confuse reactive vulnerability scanning (Option C) with proactive configuration enforcement, or mistakenly think manual documentation (Option A) or faster rebuilds (Option D) address the continuous drift problem.

How to eliminate wrong answers

Option A is wrong because documenting deviations and relying on manual checks is reactive and does not prevent drift from recurring, especially after emergency troubleshooting. Option C is wrong because running vulnerability scans more often only detects drift after it occurs, and closing findings in a ticketing system does not enforce the baseline or prevent re-enabling of services. Option D is wrong because increasing storage capacity to rebuild images faster does not prevent configuration drift; it only reduces recovery time after a rebuild, which is not a proactive solution.

Practice this question →

113

MCQeasy

An HR department wants each employee to access only the systems required for their job. A new hire should receive the same permissions as other HR specialists, and changes to the role should update access centrally. Which access model should be used?

A.Role-based access control (RBAC)

B.Attribute-based access control (ABAC)

C.Multi-factor authentication (MFA)

D.Privileged access management (PAM)

AnswerA

Role-based access control (RBAC) maps permissions to job roles rather than to individuals; HR can define a role like 'HR Specialist' with access solely to the HRIS, payroll, and recruitment systems, then assign employees into that role. This centralizes onboarding, role changes, and terminations because access changes to a role propagate to all members, which directly satisfies the need for each employee to access only the systems their job requires. RBAC enforces least privilege at the role level, making it the correct access control model for this scenario.

Why this answer

Role-based access control (RBAC) is the correct model because it assigns permissions based on job roles (e.g., HR specialist), ensuring that a new hire automatically inherits the same access as others in that role. Centralized role management allows changes to the role's permissions to propagate to all members, meeting the requirement for centralized updates.

Exam trap

The trap here is that candidates often confuse ABAC with RBAC because both can use attributes, but RBAC relies on static role assignments, whereas ABAC evaluates dynamic attributes at runtime, making RBAC the correct choice for role-based inheritance and centralized updates.

How to eliminate wrong answers

Option B (ABAC) is wrong because it evaluates access based on attributes (e.g., time, location, department) rather than a predefined role, which would require complex policy rules for each user and does not inherently support role-based inheritance. Option C (MFA) is wrong because it is an authentication mechanism, not an access control model; it verifies identity but does not define what resources a user can access. Option D (PAM) is wrong because it is designed to manage and monitor privileged accounts (e.g., administrators), not to assign standard user permissions based on job roles.

Practice this question →

114

MCQmedium

A security team discovers that several laptops occasionally boot from a removable drive before Windows loads, allowing unapproved recovery tools to run. Management wants to prevent this with the least impact on normal users. Which control is the best fit?

A.Disable all USB ports permanently on every laptop.

B.Enable secure boot and restrict the firmware boot order so only the approved internal boot path is allowed.

C.Uninstall the endpoint protection agent and replace it with manual inspections.

D.Move user data to cloud storage so rogue boot media can no longer access it.

AnswerB

Secure boot helps ensure the platform loads trusted boot components, while boot-order restrictions prevent users from starting the system from unapproved removable media. Together, they address the problem at the pre-OS layer and preserve normal daily use. This is a targeted hardening change that is less disruptive than disabling all external ports.

Why this answer

Secure Boot ensures that only signed, trusted firmware and bootloaders execute during the startup process. By restricting the firmware boot order to the internal drive only, the laptop will ignore removable media during boot, preventing unapproved recovery tools from running before Windows loads. This has minimal impact on normal users because they can still use USB devices after the OS has booted.

Exam trap

The trap here is that candidates may think disabling USB ports entirely is the simplest solution, but the question specifically asks for the control with the least impact on normal users, and Secure Boot with boot order restriction targets only the pre-boot phase without affecting post-boot USB functionality.

How to eliminate wrong answers

Option A is wrong because disabling all USB ports permanently would prevent legitimate use of USB peripherals (e.g., mice, keyboards, external storage) after boot, causing significant disruption to normal users. Option C is wrong because uninstalling the endpoint protection agent and replacing it with manual inspections removes automated threat detection and response, increasing security risk and administrative overhead without addressing the boot-time attack vector.

Practice this question →

115

MCQmedium

Based on the exhibit, which backup protection change best improves ransomware resilience and protects the backup media if it is stolen?

A.Enable backup encryption only, because encrypted backups cannot be read if stolen.

B.Add an immutable offline or air-gapped copy with separate backup credentials and regular restore testing.

C.Move the USB drive into a different cabinet inside the same server room.

D.Reduce the retention period so backups consume less storage space.

AnswerB

An immutable or offline copy protects backups from tampering, ransomware, and accidental deletion because the attacker cannot easily modify it. Separate credentials reduce the chance that compromised domain admin accounts can reach every backup copy. Regular restore testing ensures the organization can actually recover when needed. This is the strongest improvement in the exhibit.

Why this answer

Implementing an immutable, offline or air-gapped backup copy with separate credentials ensures that even if an attacker compromises the primary backup system or steals the media, they cannot modify or delete the backups. Regular restore testing verifies the integrity and recoverability of the data, which is critical for ransomware resilience. This approach aligns with the 3-2-1 backup rule and NIST SP 800-184 guidance for cyber recovery.

Exam trap

The trap here is that candidates often assume encryption alone (Option A) is sufficient for ransomware protection, overlooking that encryption does not prevent backup corruption or deletion, and that an immutable, air-gapped copy with separate credentials is the only option that addresses both theft and ransomware attack scenarios.

How to eliminate wrong answers

Option A is wrong because backup encryption alone does not prevent ransomware from encrypting or deleting the backup files themselves; encryption only protects data confidentiality if the media is stolen, but the attacker could still corrupt or destroy the backups before encryption is applied. Option C is wrong because moving the USB drive to a different cabinet in the same server room does not create an air gap or offline copy; the drive remains accessible to the same network and threats, and physical theft of the cabinet would still compromise the backups. Option D is wrong because reducing the retention period only frees storage space and does not improve resilience against ransomware; it actually increases the risk of data loss by shortening the recovery window, and it does not protect backups from being encrypted or deleted.

Practice this question →

116

MCQeasy

A company uses several SaaS applications and wants employees to sign in once with a corporate account instead of maintaining separate passwords for each app. Which architecture is best?

A.Shared generic accounts for each department.

B.Federated single sign-on with a central identity provider.

C.A separate username and password database in every SaaS application.

D.A site-to-site VPN for every SaaS vendor.

AnswerB

This is the best choice because a central identity provider can authenticate the user once and then issue trusted access to multiple SaaS applications. It reduces password sprawl, simplifies account provisioning, and supports faster deprovisioning when an employee leaves. Federation also improves control because the business can manage identity from one place.

Why this answer

Federated single sign-on (SSO) with a central identity provider (IdP) allows users to authenticate once using their corporate account (e.g., via SAML 2.0 or OIDC) and then access multiple SaaS applications without re-entering credentials. The IdP issues a token that each SaaS app trusts, eliminating the need for separate passwords while maintaining centralized control over authentication policies.

Exam trap

The trap here is that candidates confuse network-level VPN connectivity with identity-level federation, assuming a VPN can provide SSO, when in fact VPNs only secure the transport layer and do not address authentication across separate application domains.

How to eliminate wrong answers

Option A is wrong because shared generic accounts violate the principle of least privilege and non-repudiation, as multiple users share the same credentials, making it impossible to audit individual actions. Option C is wrong because maintaining a separate username and password database in every SaaS application directly contradicts the requirement to eliminate separate passwords and introduces redundant identity silos. Option D is wrong because a site-to-site VPN provides network-layer connectivity, not identity federation; it does not solve the problem of authenticating users across different SaaS applications without separate credentials.

Practice this question →

117

MCQmedium

A regulated analytics workload must run in the cloud with the strongest isolation from other customers, but the company does not want to manage its own physical server room. Which placement is most appropriate?

A.A public subnet with an internet gateway so the workload can be reached directly.

B.A shared-tenancy virtual machine in the provider's default compute pool.

C.A dedicated host or equivalent single-tenant compute placement in the provider's environment.

D.A serverless function because it removes all underlying infrastructure concerns.

AnswerC

A dedicated host (or an equivalent single-tenant placement such as an AWS Dedicated Host, Azure Dedicated Host, or GCP sole-tenant node) assigns an entire physical server to a single customer, eliminating co-tenant compute activity on that machine. This physical isolation directly addresses regulatory mandates that require data containment, while still allowing the cloud provider to manage hardware maintenance and updates. It also enables consistent instance placement, brings-your-own-license (BYOL) scenarios, and helps meet stringent compliance frameworks such as HIPAA, PCI DSS, or FedRAMP.

Why this answer

A dedicated host or single-tenant compute placement ensures that the physical server is not shared with any other customer, providing the strongest isolation required for regulated workloads. This model meets the compliance need for physical separation while still being a cloud service, so the company avoids managing its own server room.

Exam trap

The trap here is that candidates often confuse logical isolation (e.g., VPCs, private subnets) with physical isolation, and mistakenly choose a shared-tenancy option like a private subnet VM, thinking it provides the strongest separation.

How to eliminate wrong answers

Option A is wrong because a public subnet with an internet gateway exposes the workload directly to the internet, which weakens security and does not provide any physical isolation from other customers. Option B is wrong because a shared-tenancy virtual machine runs on hardware shared with other customers, offering only logical isolation and failing the requirement for the strongest physical isolation. Option D is wrong because serverless functions run on shared infrastructure managed by the provider, with no guarantee of single-tenant physical isolation, and they do not meet the explicit need for the strongest isolation from other customers.

Practice this question →

118

MCQhard

Company-owned tablets are used by field staff for both corporate email and approved personal apps. Security must isolate company data from personal data, allow remote wipe of only the corporate workspace, and block access if the device is rooted or encryption is disabled. Which approach best fits?

A.Use a consumer anti-malware app and perform a full-device wipe if the tablet is lost.

B.Use MDM or UEM with a managed work profile or container, compliance checks, and selective wipe.

C.Install a VPN app on the tablets and let users choose their own lock-screen settings.

D.Use application allowlisting alone and avoid enrolling the tablets in a management platform.

AnswerB

An MDM/UEM solution with a managed work profile or container separates corporate apps and data into an isolated, policy-controlled space on the same tablet, leaving personal content untouched. Compliance checks—such as validating passcode strength, OS patch level, and rooting/jailbreak status—allow the system to block access to corporate resources on noncompliant devices. A selective wipe then removes only the managed container and corporate data if needed, preserving the user’s personal information, which perfectly suits company-owned tablets used for both purposes.

Why this answer

Mobile Device Management (MDM) or Unified Endpoint Management (UEM) with a managed work profile (e.g., Android Work Profile or iOS Managed Open In) creates a separate, encrypted container for corporate data. This allows compliance checks to detect rooted devices or disabled encryption, and enables a selective wipe that removes only the corporate workspace without affecting personal apps or data.

Exam trap

The trap here is that candidates often confuse a full-device wipe (which destroys personal data) with a selective wipe (which only removes the corporate container), or assume that a VPN or anti-malware app alone can provide the required isolation and compliance enforcement.

How to eliminate wrong answers

Option A is wrong because a consumer anti-malware app cannot enforce containerization or selective wipe; a full-device wipe destroys all personal data, violating the requirement to isolate and preserve personal data. Option C is wrong because a VPN app alone does not provide work profile isolation, compliance checks for root/encryption, or selective wipe capabilities; letting users choose lock-screen settings undermines security policy enforcement. Option D is wrong because application allowlisting without a management platform cannot create a separate corporate workspace, enforce encryption or root detection, or perform a selective wipe; it only controls which apps can run, not data isolation or remote wipe.

Practice this question →

119

MCQmedium

A legacy finance application cannot yet support multifactor authentication. The security team still wants administrators to use separate privileged accounts, receive elevated access only when a ticket is approved, and have those privileges removed automatically after the maintenance window ends. Which solution best fits?

A.Create one shared administrator account and rotate its password every week.

B.Assign permanent administrator rights through role-based access control and rely on audit logs afterward.

C.Use privileged access management with separate admin accounts and time-bound elevation approvals.

D.Move the application behind a federation service so all users can sign in with a single password.

AnswerC

Privileged access management is designed for this situation. Separate admin accounts preserve accountability, while time-bound elevation reduces standing privilege and limits exposure when the elevated rights are not needed. Approval workflows also support operational control and can be tied to maintenance tickets for traceability.

Why this answer

Privileged Access Management (PAM) solutions are specifically designed to enforce just-in-time (JIT) privileged access. They allow administrators to request time-bound elevation of rights for a specific maintenance window, with automatic revocation after the window expires. This directly meets the requirements of separate privileged accounts, ticket-based approval, and automatic removal of privileges, even when the legacy application itself cannot support MFA.

Exam trap

The trap here is that candidates may confuse federation (SSO) with privileged access management, thinking that a single sign-on solution can enforce time-bound elevation, when in fact federation only centralizes authentication and does not manage granular, time-limited privilege escalation.

How to eliminate wrong answers

Option A is wrong because a shared administrator account violates the principle of least privilege and non-repudiation; rotating the password weekly does not provide time-bound, ticket-approved elevation or automatic removal of privileges. Option B is wrong because permanent administrator rights through RBAC contradict the requirement for elevated access only when a ticket is approved and automatic removal after the maintenance window; audit logs alone do not enforce time-bound access. Option D is wrong because placing the application behind a federation service with a single password does not provide separate privileged accounts, ticket-based approval, or time-bound elevation; it also introduces a single point of failure and does not address the need for privileged access management.

Practice this question →

120

Multi-Selecthard

A router interface connects the DMZ subnet 10.10.10.0/24 to the internal network. A web server at 10.10.10.25 must reach an application server at 10.10.20.20 on TCP 8443, and all other DMZ-to-internal traffic must be blocked. Which two ACL entries should be applied inbound on the DMZ-facing interface? Select two.

Select 2 answers

A.permit tcp 10.10.10.25 host 10.10.20.20 eq 8443

B.permit tcp host 10.10.20.20 any eq 8443

C.deny ip 10.10.10.0/24 10.10.20.0/24

D.permit ip any any

E.permit udp 10.10.10.0/24 host 10.10.20.20 eq 8443

AnswersA, C

This rule allows only the required web-server-to-application-server connection on the specified port. It uses a very narrow source and destination definition, which is the safest way to permit the business flow. The ACL should allow the needed application traffic and nothing broader than that.

Why this answer

It permits TCP traffic from the specific web server (10.10.10.25) to the application server (10.10.20.20) on destination port 8443, which is the only allowed DMZ-to-internal communication. This entry uses the 'host' keyword to specify the exact source IP and the 'eq' keyword to match the required destination port, implementing the principle of least privilege.

Exam trap

The SY0-701 exam often tests the misconception that a single permit statement is sufficient, but candidates forget that an explicit deny entry is needed to block all other traffic when the requirement specifies 'all other traffic must be blocked', as the implicit deny alone does not satisfy the explicit blocking requirement in the question.

Practice this question →

121

Multi-Selecthard

A company is evaluating a multi-tenant SaaS document platform. The security team wants to reduce the impact of another tenant’s breach and ensure employees who leave are removed from the app within minutes. Which two requirements should the team prioritize? Select two.

Select 2 answers

A.Require the provider to document logical tenant isolation and separate customer encryption keys.

B.Use a shared local administrator account for the app so offboarding is easier.

C.Allow anonymous public links as the default method for external collaboration.

D.Integrate the SaaS with the corporate IdP using federation and SCIM lifecycle automation.

E.Rely on manual quarterly cleanup tickets to disable former employees.

AnswersA, D

Logical tenant isolation helps prevent one tenant from reading or influencing another tenant’s data. Separate customer encryption keys further reduce cross-tenant risk because encrypted content is not protected by a single shared key set. Together, these requirements are useful when evaluating multi-tenant SaaS risk and selecting a provider with stronger separation controls.

Why this answer

Logical tenant isolation (e.g., separate databases or namespaces) and separate customer encryption keys ensure that a breach in one tenant cannot access another tenant's data, directly reducing the impact of cross-tenant attacks. This aligns with the shared responsibility model in SaaS, where the provider must enforce strong multi-tenant boundaries at the application and data layers.

Exam trap

The trap here is that candidates may confuse 'shared local admin account' (Option B) with efficient offboarding, but it actually undermines security and auditability, while the correct approach is federation with SCIM for automated lifecycle management.

Practice this question →

122

MCQeasy

A customer-facing website must stay available if one of two application servers fails. Which design should the team implement?

A.A single server with a larger power supply

B.A load balancer in front of multiple application servers

C.A daily screenshot of the website

D.A more restrictive password policy

AnswerB

A load balancer can send traffic to a healthy server if one instance becomes unavailable.

Why this answer

A load balancer distributes incoming traffic across multiple application servers, providing high availability and fault tolerance. If one server fails, the load balancer automatically redirects traffic to the remaining healthy server(s), ensuring the website remains accessible. This design directly addresses the requirement for continued availability despite a single server failure.

Exam trap

The trap here is that candidates may confuse high availability with other security or operational measures, such as backups or password policies, failing to recognize that only redundant infrastructure with automatic failover can maintain uptime during a server failure.

How to eliminate wrong answers

Option A is wrong because a larger power supply only addresses power redundancy for a single server, not server-level failure; if the server itself fails, the website goes down regardless of power capacity. Option C is wrong because a daily screenshot captures a static image of the website at a point in time and does nothing to maintain live availability or handle server failures. Option D is wrong because a more restrictive password policy improves authentication security but has no impact on server redundancy or application availability.

Practice this question →

123

Multi-Selecteasy

A DevOps team stores container images in a registry before deployment. Which two practices reduce the chance of deploying a risky image? Select two.

Select 2 answers

A.Scan images for known vulnerabilities before they are promoted to production.

B.Use trusted minimal base images and remove unnecessary packages.

C.Run containers as root by default to simplify troubleshooting.

D.Mount the host operating system filesystem into every container.

E.Deploy images using the latest tag without reviewing version history.

AnswersA, B

Image scanning leverages CVE databases to identify known vulnerabilities in the image's packages and libraries during the CI/CD pipeline. This proactive control ensures that only images passing defined security policies, such as a maximum allowed severity score, are promoted to production. It also enables early remediation at a stage where fixes are relatively inexpensive and before attackers can exploit the flaws.

Why this answer

Scanning container images for known vulnerabilities (e.g., using tools like Trivy or Clair) identifies CVEs in the OS packages or application dependencies before the image reaches production. This proactive check prevents deploying images with exploitable flaws, aligning with secure software supply chain practices. Option B is correct because using trusted minimal base images (e.g., Alpine or distroless) reduces the attack surface, and removing unnecessary packages eliminates potential vulnerabilities from unused components, following the principle of least functionality.

Exam trap

CompTIA often tests the misconception that running containers as root is acceptable for troubleshooting, but the SY0-701 exam emphasizes that containers should always run with the least privileges necessary, and the latest tag is a security anti-pattern because it breaks deterministic deployments.

Practice this question →

124

MCQmedium

A company is concerned about ransomware and insider tampering with backups. It wants daily restore points, monthly archives, and protection if a backup drive is stolen from the storage room. Which backup design is the best answer?

A.Store all backups on a shared file server so administrators can restore them quickly.

B.Use encrypted, immutable backups with an offline or offsite copy and defined retention periods.

C.Keep only the most recent snapshot to reduce storage cost and simplify recovery.

D.Rely on RAID mirroring because it automatically creates a secure archival copy.

AnswerB

Encrypted, immutable backups prevent unauthorized reads via encryption and unauthorized writes via write-once-read-many (WORM) or object lock controls. Keeping an offline or offsite copy provides an air-gapped or geographically separate recovery source that survives ransomware propagation and physical disasters. Defining retention periods ensures you keep enough recovery points for your recovery point objective (RPO) while avoiding indefinite storage growth, and it also supports legal or compliance needs.

Why this answer

Encrypted, immutable backups prevent ransomware from encrypting or modifying backup data, and an offline or offsite copy protects against physical theft of the backup drive. Defined retention periods satisfy the daily restore points and monthly archives requirement, while immutability ensures backup integrity even if an attacker gains access to the backup system.

Exam trap

The trap here is that candidates often confuse high-availability features like RAID with backup security, or assume that network-accessible storage is sufficient, failing to recognize that immutability and offline/offsite copies are essential for ransomware and theft protection.

How to eliminate wrong answers

Option A is wrong because storing backups on a shared file server exposes them to the same ransomware and insider threats as the production environment, and it lacks immutability or offline protection. Option C is wrong because keeping only the most recent snapshot eliminates the ability to restore from daily restore points or monthly archives, violating the stated requirements. Option D is wrong because RAID mirroring provides high availability and redundancy against disk failure, but it does not create immutable or offline copies, nor does it protect against ransomware encryption or theft of the backup drive.

Practice this question →

125

Multi-Selectmedium

A company uses a SaaS CRM platform. The provider patches the application and underlying infrastructure. Which two responsibilities remain with the company? Select two.

Select 2 answers

A.Set up MFA, conditional access, and user-role assignments for tenant accounts.

B.Patch the SaaS application's source code on the provider's servers.

C.Decide what customer data is entered into the service and how it is shared.

D.Replace the provider's hypervisors with company-owned hardware.

E.Maintain the provider's network firewalls and datacenter cooling systems.

AnswersA, C

In a SaaS model, the provider owns the application, but the customer remains responsible for tenant-level identity controls. This means configuring multi-factor authentication for every account, setting conditional access rules to restrict sign-ins by device risk or geolocation, and assigning role-based permissions using the app's native admin center or an integrated identity provider like Azure AD. Without these controls, a single compromised credential can expose the entire tenant, regardless of how well the provider patches its code.

Why this answer

In a SaaS model, the customer retains responsibility for securing their tenant accounts, including configuring multi-factor authentication (MFA), conditional access policies, and role-based access control (RBAC) for users. These are identity and access management (IAM) controls that the provider cannot enforce on behalf of the customer, as they depend on the customer's specific user directory and security policies.

Exam trap

The trap here is that candidates confuse the SaaS model with IaaS or PaaS, mistakenly thinking the customer is responsible for patching the application or infrastructure, when in fact the customer's duties are limited to account and data governance.

Practice this question →

126

MCQmedium

The help desk can patch endpoints only after testing on a few pilot systems because one legacy app sometimes breaks after updates. What patching approach is most secure and least disruptive?

A.Apply updates to a small pilot group first, then roll them out in stages to the rest of the fleet.

B.Wait until all applications are fully modernized before installing any security updates.

C.Patch every endpoint immediately at the same time without testing to reduce management overhead.

D.Disable automatic updates permanently and patch only after a confirmed incident.

AnswerA

Deploying to a small pilot group first lets IT validate the update against representative hardware and the legacy application before broader exposure. Staged rings then increase the population gradually, so if a compatibility issue emerges the blast radius is limited and the deployment can be paused or rolled back. This approach balances patch latency with stability, ensuring known vulnerabilities are remediated without risking fleet-wide outages.

Why this answer

It follows a phased rollout strategy: testing on a small pilot group first validates compatibility with the legacy app, then staged deployment minimizes disruption while ensuring security patches are applied promptly. This balances the need for security updates with the operational requirement to avoid breaking critical legacy software.

Exam trap

The trap here is that candidates may choose immediate patching (Option C) thinking speed is always best for security, ignoring the real-world need for compatibility testing to prevent operational disruption.

How to eliminate wrong answers

Option B is wrong because waiting for full modernization leaves endpoints vulnerable to known exploits indefinitely, violating the principle of timely patch management. Option C is wrong because immediate, untested patching risks breaking the legacy app across the entire fleet, causing widespread disruption and potential data loss. Option D is wrong because disabling automatic updates and patching only after an incident creates a reactive security posture, leaving systems exposed to attacks that could have been prevented.

Practice this question →

127

MCQmedium

A Linux server is being prepared for production as a database host. The build team notices that a graphical desktop environment, an unused FTP service, and an open mail submission port are present on the image, even though none of them are required. The organization wants future builds to be consistent and easy to verify. What is the best approach?

A.Leave the image unchanged so troubleshooting remains easier for administrators.

B.Use the image only for development and skip security review for production.

C.Create and enforce a hardened build standard that removes unnecessary services and ports, then validate future servers against it.

D.Add another firewall rule set and keep every installed service in place.

AnswerC

A hardened build standard defines exactly which services, packages, and ports are allowed on the server. Removing the graphical environment, FTP service, and unnecessary mail port reduces the attack surface. Validating future systems against the standard also makes the build repeatable and helps identify drift quickly.

Why this answer

It establishes a hardened baseline configuration that removes unnecessary services (e.g., FTP on port 21) and closes unused ports (e.g., mail submission port 587), ensuring consistency and simplifying verification. This aligns with the principle of minimizing attack surface by disabling all non-essential components before production deployment. A hardened build standard also enables automated compliance checks (e.g., using CIS benchmarks or OpenSCAP) to validate future servers against the defined secure state.

Exam trap

The trap here is that candidates may think leaving the image unchanged aids troubleshooting (Option A), but in security architecture, consistency and minimal attack surface always take precedence over convenience, and a hardened standard is the only way to ensure repeatable, verifiable builds.

How to eliminate wrong answers

Option A is wrong because leaving the image unchanged with a graphical desktop, unused FTP service, and open mail submission port increases the attack surface and violates the principle of least functionality, making security audits more difficult rather than easier. Option B is wrong because using the image only for development and skipping security review for production introduces unnecessary risk; production systems must undergo security review regardless of their origin, and development images often contain insecure defaults that should not be promoted without hardening.

Practice this question →

128

MCQeasy

A company moves a Linux server to infrastructure as a service (IaaS). Which task remains the customer's responsibility?

A.Patching the guest operating system and installed applications.

B.Replacing failed power supplies in the data center.

C.Maintaining the hypervisor on the host system.

D.Building and securing the provider's network backbone.

AnswerA

This is the best answer because in IaaS the customer still manages the guest operating system and the software running on it. The cloud provider handles the underlying physical infrastructure, but the customer is responsible for keeping the VM patched and hardened. That distinction is a key part of the shared responsibility model.

Why this answer

In an IaaS model, the cloud provider manages the physical infrastructure, hypervisor, and network backbone, while the customer retains responsibility for securing and maintaining the guest operating system and any installed applications. This includes applying security patches, updating software, and configuring the OS-level firewall. For a Linux server, the customer must run commands like `apt update && apt upgrade` or `yum update` to patch the OS and manage application dependencies.

Exam trap

The trap here is that candidates often confuse IaaS with PaaS or SaaS, assuming the provider patches the OS, but in IaaS the customer retains full control and responsibility for the guest operating system and applications.

How to eliminate wrong answers

Option B is wrong because replacing failed power supplies in the data center is the responsibility of the IaaS provider, who manages the physical hardware and facility infrastructure. Option C is wrong because maintaining the hypervisor on the host system is the provider's duty under IaaS, as the hypervisor is part of the virtualization layer that the customer does not control. Option D is wrong because building and securing the provider's network backbone is entirely the provider's responsibility; the customer only manages virtual networks and security groups within their tenant.

Practice this question →

129

Multi-Selectmedium

Employees use a browser SaaS portal, a native mobile app, and an internal API. The company wants one corporate identity, reduced password reuse, and automated removal of access when HR terminates users. Which two solutions best meet the requirement? Select two.

Select 2 answers

A.Create separate local usernames and passwords in each application for every employee.

B.Use federation so the SaaS apps trust the company's identity provider.

C.Store passwords in a shared vault and let users retrieve them when needed.

D.Automate account provisioning and deprovisioning from HR changes with SCIM or an equivalent feed.

E.Allow the mobile app to authenticate only from remembered devices, without central identity controls.

AnswersB, D

Federation lets external SaaS applications delegate authentication to the company's identity provider (IdP) using standards such as SAML 2.0 or OpenID Connect. This centralizes login, MFA, and conditional access policies in one place, eliminates the need for separate per-app credential stores, and ensures that when an employee leaves, their access to all federated apps is immediately cut off at the IdP. It directly addresses the goal of reducing credential sprawl and enforcing consistent access control across the browser portal and mobile app.

Why this answer

Federation (B) allows the SaaS portal, mobile app, and internal API to trust a single corporate identity provider (IdP) using standards like SAML 2.0 or OIDC. This gives employees one set of credentials, reduces password reuse, and enables centralized control. When HR terminates a user, the IdP can revoke access instantly, affecting all federated applications.

Exam trap

The trap here is that candidates often think federation alone solves all identity lifecycle problems, but the question explicitly requires automated removal of access, which demands a provisioning protocol like SCIM in addition to federation.

Practice this question →

130

MCQeasy

A company is placing its public web server so internet users can reach it, but the database server must stay hidden from the internet and be reachable only by the web server. Which design best supports this goal?

A.Put both servers on the same flat internal network

B.Place the web server in a DMZ and keep the database server on the internal network

C.Put the database server in the DMZ and the web server on the internal network

D.Disable the firewall so the web server can communicate freely with all hosts

AnswerB

This is the standard DMZ architecture: the web server is placed in a perimeter network (DMZ) that is exposed to the internet but isolated from the internal LAN by firewalls, while the database server remains on the more trusted internal network. Inbound internet traffic is only permitted to the web server, and the web server may establish outbound connections to the database on specific ports or application-level protocols, so even if the web server is compromised, the attacker gains no direct access to the database or other internal resources.

Why this answer

It uses a DMZ (demilitarized zone) to isolate the public-facing web server from the internal network. The web server in the DMZ is accessible from the internet, while the database server remains on the internal network, reachable only by the web server through a firewall rule that permits traffic on the specific database port (e.g., TCP 3306 for MySQL). This layered security design prevents direct internet access to sensitive data.

Exam trap

The trap here is that candidates may think placing the database server in the DMZ is acceptable because it is 'protected' by a firewall, but they overlook that the DMZ is still accessible from the internet, making the database directly reachable and violating the requirement to keep it hidden.

How to eliminate wrong answers

Option A is wrong because placing both servers on the same flat internal network exposes the database server to the internet if the web server is compromised, as there is no network segmentation to restrict lateral movement. Option C is wrong because putting the database server in the DMZ and the web server on the internal network would expose the database directly to the internet, defeating the goal of hiding it, and would require the web server to initiate outbound connections to the DMZ, which is less secure and more complex to manage.

Practice this question →

131

MCQmedium

A small company is redesigning its network for a public web application. The web front end must be reachable from the internet, but the database should never be exposed directly to external or general user traffic. Which architecture is the best choice?

A.Place both the web server and database in the same internal subnet and rely on host firewalls.

B.Place the web server in a DMZ and keep the database in a private internal subnet with only required application traffic allowed.

C.Place the database in the DMZ so the web server can query it directly without internal routing.

D.Keep both systems public but restrict access with NAT and strong administrator passwords.

AnswerB

This separates the internet-facing system from the sensitive backend. The DMZ limits exposure of the web server, while the database remains inaccessible from external networks and is reachable only over tightly filtered application ports from the web tier.

Why this answer

It implements a layered security architecture: the web server resides in a DMZ (demilitarized zone) where it is reachable from the internet, while the database is placed in a private internal subnet with strict firewall rules that only allow the required application traffic (e.g., TCP port 3306 for MySQL or 1433 for MSSQL) from the web server. This ensures the database is never directly exposed to external or general user traffic, reducing the attack surface and preventing direct internet-based attacks on the database.

Exam trap

The trap here is that candidates may think host firewalls are sufficient for internal subnet isolation (Option A) or mistakenly believe placing the database in the DMZ simplifies routing (Option C), overlooking the fundamental security principle of defense in depth and the need to keep sensitive data stores off the internet-facing network.

How to eliminate wrong answers

Option A is wrong because placing both the web server and database in the same internal subnet exposes the database to any compromise of the web server or any internal host, and host firewalls alone are insufficient to prevent lateral movement or internal scanning. Option C is wrong because placing the database in the DMZ directly exposes it to the internet, defeating the purpose of isolation and making it vulnerable to direct attacks from external sources.

Practice this question →

132

MCQmedium

In a virtualized environment, several workloads share the same physical host and the same IP subnet. After one payroll VM is compromised, the security team wants to prevent that VM from freely scanning or reaching the other workloads on the host. Which control best addresses this lateral-movement risk?

A.Microsegmentation with policy rules applied per workload or per VM

B.Expanding the subnet mask so all workloads are easier to reach

C.Creating a shared administrator account for all virtual machines

D.Disabling DHCP and forcing every VM to use a static IP address

AnswerA

Microsegmentation creates fine-grained trust boundaries between workloads, even when they share the same subnet or host. This limits east-west traffic and reduces the ability of a compromised VM to discover or attack neighboring systems. It is the most direct control for this risk.

Why this answer

Microsegmentation allows granular security policies to be applied per workload or per VM, even within the same subnet and on the same hypervisor. By enforcing firewall rules at the virtual switch or hypervisor level, it prevents a compromised payroll VM from scanning or communicating laterally with other VMs on the same host, directly addressing the lateral-movement risk.

Exam trap

The trap here is that candidates often confuse subnetting or IP addressing changes (like expanding the subnet mask or using static IPs) with actual network security controls, failing to realize that only policy-based segmentation at the hypervisor or virtual switch layer can block lateral traffic within the same broadcast domain.

How to eliminate wrong answers

Option B is wrong because expanding the subnet mask (e.g., from /24 to /16) actually increases the broadcast domain and makes more IP addresses reachable, which would facilitate lateral movement rather than prevent it. Option C is wrong because creating a shared administrator account for all VMs would reduce accountability and provide an attacker with a single set of credentials to compromise all workloads, increasing lateral-movement risk. Option D is wrong because disabling DHCP and forcing static IPs does not restrict network communication between VMs; it only changes how IP addresses are assigned, leaving all traffic unblocked and the VM free to scan the subnet.

Practice this question →

133

Multi-Selecteasy

A company wants employees to use their normal login from managed devices but require extra verification when they sign in from an unmanaged laptop or a new location. Which two controls should the team use? Select two.

Select 2 answers

A.Conditional access

B.Multi-factor authentication

C.DNS filtering

D.Disk encryption

E.Port security

AnswersA, B

Conditional access is an identity-driven policy engine in Microsoft Entra ID that evaluates real-time signals such as user location, device compliance, and risk before granting access. Instead of applying a one-size-fits-all rule, it can require step-up authentication, block access, or restrict sessions based on conditions like a managed or unmanaged device. This makes it the most appropriate control for requiring different sign-in conditions based on context.

Why this answer

Conditional access (A) is correct because it allows the company to define policies that grant or block access based on conditions such as device compliance (managed vs. unmanaged) and location (trusted vs. new). Multi-factor authentication (B) is correct because it provides the extra verification step required when the conditional access policy detects an unmanaged laptop or a new location, ensuring the user proves their identity beyond just a password.

Exam trap

The trap here is that candidates often pick MFA alone, forgetting that MFA is only enforced when a conditional access policy triggers it based on device or location conditions, so both controls are needed together.

Practice this question →

134

Multi-Selectmedium

A customer portal must keep serving users if one application server fails and also remain available if the primary site becomes unreachable. Management prefers automatic recovery over manual intervention. Which two design choices best satisfy the goal? Select two.

Select 2 answers

A.Deploy multiple application servers behind a load balancer across separate availability zones.

B.Use a single high-end server with RAID 10 and a larger power supply.

C.Keep only nightly backups and restore manually after an outage.

D.Store the database on a local disk array attached to the primary server.

E.Replicate the database to a standby site with automatic failover.

AnswersA, E

This design achieves high availability by removing the single point of failure at the application tier. The load balancer distributes traffic across multiple servers and performs periodic health checks, automatically removing any instance that fails. Deploying across separate availability zones (AZs) also protects against an entire data-center outage, because the load balancer can continue routing to healthy instances in the remaining AZs. This is a classic active-active pattern that provides automatic failover and scales horizontally to handle increased user load.

Why this answer

Deploying multiple application servers behind a load balancer across separate availability zones (A) provides redundancy at the application tier: if one server fails, traffic is automatically redirected to healthy servers. Replicating the database to a standby site with automatic failover (E) ensures that if the primary site becomes unreachable, the database can be promoted to active without manual intervention, meeting the requirement for automatic recovery.

Exam trap

CompTIA often tests the misconception that hardware redundancy (like RAID 10) alone is sufficient for high availability, but it ignores site-level failures and automatic recovery requirements.

Practice this question →

135

Multi-Selectmedium

A team deploys a Linux virtual machine in IaaS and stores documents in a managed cloud object storage service. The provider secures datacenters, hardware, and the storage platform, but the organization still wants to reduce exposure. Which two tasks remain the organization's responsibility? Select two.

Select 2 answers

A.Patch and harden the Linux virtual machine operating system.

B.Replace the provider's datacenter controls with a customer-owned firewall appliance.

C.Assume the provider will apply tenant-specific application permissions automatically.

D.Configure IAM roles, bucket policies, and least-privilege access for the customer's resources.

E.Rely on the cloud provider to classify the company's documents for compliance.

AnswersA, D

In Infrastructure as a Service (IaaS), the cloud provider secures the physical host and hypervisor, but the customer retains administrative control over the guest OS, including the kernel, installed packages, and running services. Patching known CVEs and applying security hardening measures (e.g., disabling unnecessary services, enabling SELinux/AppArmor, enforcing minimum file permissions) directly reduce the VM's attack surface. This responsibility falls squarely on the customer under the shared responsibility model because the VM is effectively a customer-managed server, and failing to patch leaves known exploitable vulnerabilities.

Why this answer

In an IaaS model, the customer is responsible for securing the operating system of the virtual machine, including applying patches and hardening configurations. The cloud provider secures the underlying hypervisor and physical infrastructure, but the customer must manage the OS-level security controls.

Exam trap

The trap here is that candidates often assume the cloud provider handles all security for managed services, but the shared responsibility model clearly places OS patching and access control configuration on the customer, even for IaaS and object storage.

Practice this question →

136

MCQmedium

A regulated workload must run in the cloud with the strongest possible isolation from other tenants, and the company wants to avoid managing its own physical hardware. Which placement is the best fit?

A.Use a dedicated host so the underlying hardware is allocated to one customer only.

B.Use a shared tenancy instance with tighter security groups and a private subnet.

C.Move the workload into a public subnet so the provider can inspect traffic more easily.

D.Use a container within a shared platform because containers always isolate tenants completely.

AnswerA

A dedicated host provides the highest level of tenant isolation without requiring the organization to own or maintain the physical server. It is a strong fit for regulated workloads where the business wants reduced sharing at the hardware layer.

Why this answer

A dedicated host provides the strongest possible isolation by ensuring that the physical server is not shared with any other tenant. This meets the requirement for a regulated workload without the company managing its own hardware, as the cloud provider still handles maintenance and patching.

Exam trap

The trap here is that candidates often confuse logical isolation (like security groups or private subnets) with physical isolation, assuming that network controls alone satisfy the requirement for the strongest possible isolation from other tenants.

How to eliminate wrong answers

Option B is wrong because shared tenancy instances, even with tighter security groups and a private subnet, still share the underlying physical hardware with other tenants, which does not meet the requirement for the strongest possible isolation. Option C is wrong because moving the workload into a public subnet exposes it directly to the internet and does not enhance isolation; the provider inspecting traffic does not prevent resource sharing at the hardware level.

Practice this question →

137

MCQmedium

A company uses a third-party expense application and wants employees to sign in with their corporate identity once, then automatically lose access in the expense app when they are terminated in the HR system. Which solution best meets both requirements?

A.Create separate local usernames in the expense app and synchronize passwords weekly.

B.Implement federated single sign-on and automated user provisioning and deprovisioning.

C.Require a VPN connection before users can open the expense app.

D.Use a shared generic account for all employees and rotate the password monthly.

AnswerB

Federated single sign-on, using SAML 2.0 or OIDC, lets employees authenticate with their existing corporate credentials through an identity provider (IdP), so the expense app never stores separate passwords. Automated provisioning via SCIM or similar APIs creates, updates, and disables accounts based on authoritative HR/directory data, ensuring deprovisioning happens in near real-time when an employee leaves or changes roles. This gives the company centralized visibility and control over access, reduces orphaned accounts, and satisfies audit requirements for identity lifecycle management.

Why this answer

Federated single sign-on (SSO) allows users to authenticate once using their corporate identity (e.g., via SAML or OIDC), and automated provisioning/deprovisioning (often via SCIM) ensures that when an employee is terminated in the HR system, their access to the expense app is automatically revoked. This meets both requirements: seamless sign-in and immediate loss of access upon termination.

Exam trap

The trap here is that candidates may think VPN or password synchronization provides adequate access control, but they fail to recognize that only federated SSO combined with automated provisioning/deprovisioning ensures both seamless authentication and immediate revocation tied to the corporate identity lifecycle.

How to eliminate wrong answers

Option A is wrong because creating separate local usernames and synchronizing passwords weekly does not provide single sign-on (users still need separate credentials) and weekly sync introduces a delay, so terminated employees could retain access for up to a week. Option C is wrong because requiring a VPN connection controls network access but does not address authentication or automated deprovisioning; a terminated employee could still sign in if their credentials are valid. Option D is wrong because a shared generic account violates the principle of individual accountability, cannot tie access to a specific employee's termination, and monthly password rotation does not automatically revoke access upon termination.

Practice this question →

138

MCQmedium

An HR portal has three job functions: HR staff update employee records, managers approve leave requests, and payroll views salary data. The security team wants to prevent any one role from having all capabilities. Which access design is the best fit?

A.Use a single superuser account for the entire department so tasks can be completed quickly.

B.Create role-based access groups aligned to each job function and grant only the permissions needed for that role.

C.Give every employee access to all portal features and depend on audit logs to catch mistakes later.

D.Require the payroll team to share one common password and use it only from the office network.

AnswerB

Role-based access control is the right design because it maps permissions to job responsibilities. HR, managers, and payroll each receive only the access they need, which supports separation of duties and makes access reviews easier. It also reduces the chance that one user or one account can perform every sensitive action in the portal.

Why this answer

Role-based access control (RBAC) is the correct design because it enforces the principle of least privilege by granting each job function only the permissions necessary for its tasks. This prevents any single role from accumulating all capabilities (e.g., HR staff cannot approve leave or view salary data), directly addressing the security team's requirement to separate duties. RBAC aligns with NIST SP 800-53 AC-6 and is a standard access control model for multi-role enterprise applications.

Exam trap

The trap here is that candidates may confuse 'role-based access control' with 'discretionary access control' (DAC) or think that audit logs alone are sufficient for security, but the SY0-701 exam emphasizes that preventive controls (like RBAC) are superior to detective controls (like logging) for enforcing separation of duties.

How to eliminate wrong answers

Option A is wrong because a single superuser account violates separation of duties and least privilege, granting all capabilities to one user and increasing the risk of insider threats or credential compromise. Option C is wrong because giving every employee full access to all portal features removes all access controls, making the system reliant solely on audit logs for detection rather than prevention, which is a security anti-pattern. Option D is wrong because shared passwords eliminate non-repudiation and accountability, and restricting access by network location (e.g., office network) does not prevent a single role from having all capabilities; it only adds a weak perimeter control.

Practice this question →

139

MCQmedium

An HR portal has three groups: HR staff can edit employee records, managers can approve leave, and payroll can view salary data. No one should have all functions. Which access model should the engineer implement?

A.Role-based access control with separate groups mapped to each business function.

B.A single shared admin account so all tasks can be completed quickly.

C.Mandatory access control with all users assigned the same clearance level.

D.Local account creation on the portal for each user, with permissions assigned manually one by one.

AnswerA

RBAC fits business duties well and keeps access aligned to job functions instead of individual exceptions.

Why this answer

Role-Based Access Control (RBAC) allows the engineer to define three distinct roles (HR staff, managers, payroll) with granular permissions mapped to specific business functions, ensuring no single user inherits all privileges. This model enforces the principle of least privilege by separating duties across groups, preventing any user from having full access to the portal's sensitive operations.

Exam trap

The trap here is that candidates may confuse RBAC with MAC or DAC, assuming that any access control model can enforce separation of duties, but only RBAC with distinct role groups directly addresses the requirement of mapping business functions to permissions without granting overlapping privileges.

How to eliminate wrong answers

Option B is wrong because a single shared admin account violates the principle of least privilege and separation of duties, as it would grant all three functions to anyone using the account, making auditing and accountability impossible. Option C is wrong because Mandatory Access Control (MAC) with all users assigned the same clearance level would not differentiate between HR, managers, and payroll functions; MAC relies on labels and clearances, not job roles, so it cannot enforce the required separation of business functions. Option D is wrong because local account creation with manual permissions is not scalable, introduces administrative overhead, and lacks the centralized, role-based grouping needed to enforce consistent separation of duties across the portal.

Practice this question →

140

MCQmedium

Based on the exhibit, which wireless security change best addresses both unauthorized device access and the risk of a lost laptop connecting to corporate resources?

A.Increase the PSK length and rotate it every 30 days.

B.Move the SSID to WPA2-Enterprise or WPA3-Enterprise with 802.1X, device certificates, and MDM-based compliance checks.

C.Hide the SSID and enable MAC address filtering on the access points.

D.Keep the current wireless design and rely on a VPN client for all remote access.

AnswerB

Enterprise Wi-Fi uses individual authentication instead of a shared passphrase, so access can be tied to a specific user or device. Device certificates and MDM compliance checks strengthen control over enrolled endpoints and make it easier to revoke access for lost or noncompliant devices. This is the most secure and manageable architecture shown by the exhibit.

Why this answer

WPA2-Enterprise or WPA3-Enterprise with 802.1X, device certificates, and MDM-based compliance checks provides mutual authentication and per-user, per-session encryption. This eliminates the risk of a lost laptop connecting to corporate resources (since device certificates can be revoked) and prevents unauthorized device access through certificate-based authentication and MDM compliance enforcement, unlike shared PSK which cannot be individually revoked.

Exam trap

The trap here is that candidates often think hiding the SSID or MAC filtering provides meaningful security, but these are easily bypassed and do not address revocation or per-device authentication, while PSK rotation seems proactive but fails to solve the lost-laptop revocation problem.

How to eliminate wrong answers

Option A is wrong because increasing PSK length and rotating it every 30 days still uses a shared pre-shared key, which cannot be individually revoked if a laptop is lost; any device with the current PSK can connect, and rotating the PSK requires reconfiguring all authorized devices, causing operational overhead. Option C is wrong because hiding the SSID and enabling MAC address filtering are trivial security measures: SSID hiding is easily defeated by passive monitoring (the SSID is broadcast in probe requests and beacons), and MAC addresses can be spoofed, so neither prevents a lost laptop from connecting nor stops unauthorized devices. Option D is wrong because relying solely on a VPN client without changing the wireless security leaves the network open to unauthorized devices connecting directly to the wireless LAN; a lost laptop with VPN credentials could still connect to the corporate network via the wireless SSID before the VPN is established, and there is no per-device revocation mechanism.

Practice this question →

141

MCQmedium

A development team deploys a Linux web server on an IaaS cloud VM. The cloud provider secures the datacenter, hardware, and hypervisor. Which control remains the organization's responsibility?

A.Monitor physical badge access at the provider facility.

B.Apply OS patches and harden services running inside the virtual machine.

C.Replace the provider's network backbone with a private carrier circuit.

D.Ensure the hypervisor is updated before every release cycle.

AnswerB

Under IaaS, the customer retains full administrative control of the guest operating system and all software running inside the virtual machine, which carries the obligation to apply security patches and harden services. This includes updating the OS kernel and installed packages, disabling unnecessary daemons, configuring host-based firewalls, and enforcing least-privilege access to the VM. The provider does not have visibility or responsibility for the guest OS, so any unpatched vulnerability or weak service configuration inside the VM is solely the customer's risk.

Why this answer

In an IaaS model, the provider handles the physical infrastructure, storage, networking foundation, and hypervisor layer. The customer remains responsible for what runs on the VM, including the guest operating system, services, configuration, and application patching. Hardening the server inside the VM is therefore the correct answer because it is one of the core customer responsibilities in this cloud model.

Why others are wrong: Physical badge access and hypervisor patching are provider duties in IaaS, so the customer cannot rely on those as their own control. Replacing the provider backbone is outside the scope of the customer’s operational responsibility and is not how shared responsibility works. The question asks for the organization’s remaining duty, which is securing the guest OS and its applications.

Practice this question →

142

Multi-Selectmedium

Which four of the following are key principles of secure network architecture design that help enforce defense-in-depth? (Choose four.)

Select 4 answers

.Implementing a demilitarized zone (DMZ) for externally facing services

.Segmenting internal networks using VLANs and firewalls

.Using a single, unified security appliance at the network perimeter

.Deploying network access control (NAC) to authenticate devices before granting access

.Placing all servers on the same flat subnet for ease of management

.Utilizing virtual private networks (VPNs) for secure remote access

Why this answer

Implementing a DMZ isolates externally facing services (e.g., web, email) from the internal network, ensuring that if an attacker compromises a public-facing server, they cannot directly pivot to internal resources. This is a foundational defense-in-depth layer that enforces traffic inspection and access controls between zones.

Exam trap

The trap here is that candidates often think a single perimeter appliance is sufficient for security, but CompTIA emphasizes that defense-in-depth requires multiple, diverse controls—not a single device—to avoid a single point of failure.

Practice this question →

143

MCQmedium

Based on the exhibit, which change best meets the requirement that guest devices can reach the internet but must not reach any internal subnets or printer VLANs?

A.Add more allow rules for the printer VLAN so guests can print without changing routing.

B.Move guests into a dedicated guest zone with outbound NAT and default-deny rules to internal networks.

C.Place guest and corporate devices on the same VLAN and rely on the wireless password for separation.

D.Allow guest traffic to reach internal DNS and DHCP servers across all RFC1918 subnets.

AnswerB

A dedicated guest zone with outbound NAT and default-deny rules to internal networks satisfies the requirement by placing untrusted guests into their own security zone, one that can reach the internet but cannot initiate traffic to any RFC1918 internal address. The stateful firewall performs source NAT to the public interface, so responses return only for established outbound sessions, while explicit deny rules block guest-to-internal traffic. This enforces least privilege, prevents lateral movement, and keeps guest access strictly internet-only.

Why this answer

Placing guest devices in a dedicated guest zone with outbound NAT allows them to access the internet while default-deny rules to internal subnets and printer VLANs enforce network segmentation. This approach uses firewall policies to explicitly block RFC 1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) from guest traffic, ensuring no Layer 3 connectivity to internal resources.

Exam trap

The trap here is that candidates may think adding more allow rules (Option A) or using a shared VLAN with a password (Option C) provides sufficient isolation, but they fail to recognize that network-layer segmentation via dedicated zones and firewall rules is required to prevent guest-to-internal communication at both Layer 2 and Layer 3.

How to eliminate wrong answers

Option A is wrong because adding more allow rules for the printer VLAN would permit guest traffic to reach printers, directly violating the requirement that guests must not reach printer VLANs; it also does not address blocking access to other internal subnets. Option C is wrong because placing guest and corporate devices on the same VLAN eliminates Layer 2 segmentation, and relying solely on a wireless password provides no network-layer isolation, allowing guests to potentially communicate with corporate hosts via ARP or broadcast traffic. Option D is wrong because allowing guest traffic to internal DNS and DHCP servers across all RFC1918 subnets would create a pathway to internal networks, breaking the requirement that guests must not reach any internal subnets.

Practice this question →

144

MCQmedium

Employees must sign in to several SaaS applications with corporate credentials, and terminated users should lose access quickly without manual changes in each app. Which solution best meets the requirement?

A.Create separate local usernames and passwords in each SaaS application.

B.Use federation for sign-on and automated provisioning and deprovisioning through an identity lifecycle process.

C.Require users to share one department password for each SaaS platform.

D.Store the same password in every application vault and sync it nightly.

AnswerB

Federation allows users to authenticate with the corporate identity provider, while automated provisioning helps create, update, and disable accounts across connected SaaS apps. This design supports single sign-on, faster offboarding, and centralized control over access lifecycle changes. It also reduces the risk of forgotten orphaned accounts remaining active after termination.

Why this answer

Federation enables single sign-on (SSO) using standards like SAML 2.0 or OIDC, allowing users to authenticate once with corporate credentials across multiple SaaS apps. Automated provisioning and deprovisioning via SCIM (System for Cross-domain Identity Management) ensures that when an employee is terminated, their access is revoked from all connected applications instantly without manual intervention, meeting the requirement for rapid access removal.

Exam trap

The trap here is that candidates may confuse federation with simple SSO, overlooking the automated provisioning/deprovisioning component that is essential for the 'lose access quickly' requirement, and instead pick a password-vaulting solution thinking it centralizes credentials.

How to eliminate wrong answers

Option A is wrong because creating separate local usernames and passwords in each SaaS app requires manual management for each account, making it impossible to quickly revoke access for terminated users across all apps without individual changes. Option C is wrong because sharing one department password violates the principle of least privilege and non-repudiation, as it prevents individual accountability and does not allow targeted revocation for a single terminated user. Option D is wrong because storing the same password in every application vault and syncing it nightly does not provide immediate access revocation; a terminated user could still authenticate until the next sync, and password reuse across apps increases security risk if one vault is compromised.

Practice this question →

145

MCQhard

Employees use a browser-based SaaS portal, a native expense app, and an internal API. The company wants one corporate identity, API access without separate passwords, and automatic account removal when HR disables a user. Which solution best fits?

A.Use LDAP binds directly against each application and manage local passwords separately.

B.Use OpenID Connect federation with OAuth 2.0 access tokens and SCIM provisioning.

C.Use shared local accounts in each application and sync passwords nightly from the directory.

D.Use Kerberos constrained delegation to each vendor tenant for every application.

AnswerB

OpenID Connect (OIDC) provides a federated identity layer that supports both browser-based SSO through authorization code flows and native mobile app sign-in via PKCE, while OAuth 2.0 access tokens grant the SaaS apps scoped API access on behalf of the user. SCIM (System for Cross-domain Identity Management) automates the creation, update, and deactivation of user accounts in the SaaS applications, ensuring offboarding is immediate and no orphaned accounts linger. Together they give the organization centralized lifecycle control, strong authentication, and least-privilege API access, which is the modern standard for SaaS identity management.

Why this answer

OpenID Connect (OIDC) federation with OAuth 2.0 provides a single corporate identity (federated SSO), allows API access without separate passwords (using access tokens), and SCIM provisioning automates account removal when HR disables a user. This combination meets all three requirements: unified identity, passwordless API access, and lifecycle management.

Exam trap

The trap here is that candidates often confuse LDAP or Kerberos (both legacy on-premises protocols) with modern cloud federation, failing to recognize that OIDC + OAuth 2.0 + SCIM is the only combination that provides SSO, token-based API access, and automated provisioning for SaaS and native apps.

How to eliminate wrong answers

Option A is wrong because LDAP binds require separate password management per application and do not provide API access without passwords, nor do they support automatic account removal via SCIM. Option C is wrong because shared local accounts with nightly password sync violate the requirement for a single corporate identity and do not enable API access without passwords; they also lack automatic provisioning/deprovisioning. Option D is wrong because Kerberos constrained delegation is designed for on-premises Windows environments and does not federate to browser-based SaaS or native apps, nor does it support SCIM-based lifecycle management.

Practice this question →

146

MCQeasy

A company needs a public website that anyone on the internet can reach, but the application and database servers must stay off the internet. Where should the web server be placed?

A.On the internal user network with the database server.

B.In a DMZ separated from the internal application and database networks.

C.On the same subnet as the firewall management interface.

D.Directly on the database subnet so performance is faster.

AnswerB

A DMZ is the best choice because it allows public access to the web server while keeping the application and database tiers behind additional security controls. If the web server is compromised, the attacker still has to cross another boundary to reach internal systems. This layered zoning is a standard architecture pattern for public-facing services and helps contain risk.

Why this answer

The web server must be placed in a DMZ (demilitarized zone) because this network segment is designed to host publicly accessible services while isolating them from internal networks. The DMZ allows inbound traffic from the internet to the web server, but the application and database servers remain on internal networks with strict firewall rules that block direct internet access, enforcing a layered security architecture.

Exam trap

The trap here is that candidates often confuse a DMZ with a 'public subnet' and think placing the web server directly on the internet-facing side of the firewall is sufficient, but the DMZ is a separate, isolated network segment that enforces strict traffic inspection and prevents direct lateral movement to internal resources.

How to eliminate wrong answers

Option A is wrong because placing the web server on the internal user network with the database server would expose both to direct internet traffic, violating the requirement to keep application and database servers off the internet and creating a single point of compromise. Option C is wrong because the firewall management interface subnet is a highly restricted administrative network; placing a public web server there would expose management interfaces to attack and violate security best practices. Option D is wrong because placing the web server directly on the database subnet would allow internet traffic to reach the database server directly, bypassing the application layer and defeating the purpose of network segmentation.

Practice this question →

147

MCQeasy

A company uses a SaaS file-sharing platform for employee documents. Which action is the company's responsibility, not the provider's?

A.Patching the vendor's application servers.

B.Setting user sharing permissions and access controls for company data.

C.Replacing failed disks in the provider's storage cluster.

D.Maintaining the cloud provider's identity center and hypervisor.

AnswerB

In a SaaS model, the provider manages the application and underlying infrastructure, but the customer remains responsible for how the service is used. That includes user provisioning, access permissions, sharing settings, and data handling decisions. Configuring who can see or edit documents is a customer duty because it directly affects the organization's confidentiality and compliance obligations.

Why this answer

In a SaaS model, the provider manages the underlying infrastructure, including application servers, storage, and hypervisors. The customer is responsible for configuring access controls and permissions for their own data within the application. Option B correctly identifies this shared responsibility boundary.

Exam trap

The trap here is that candidates often confuse the SaaS model with IaaS or PaaS, incorrectly assuming the customer is responsible for patching or hardware maintenance, when in fact the provider handles all infrastructure layers in SaaS.

How to eliminate wrong answers

Option A is wrong because patching the vendor's application servers is the provider's responsibility under the SaaS shared responsibility model, not the customer's. Option C is wrong because replacing failed disks in the provider's storage cluster is an infrastructure maintenance task owned by the SaaS provider. Option D is wrong because maintaining the cloud provider's identity center and hypervisor is part of the provider's responsibility for the underlying platform, not the customer's.

Practice this question →

148

MCQmedium

Based on the exhibit, which network redesign would best limit lateral movement between user endpoints and building systems after a workstation compromise?

A.Move every device into a single flat subnet so internal routing is simpler.

B.Separate workstations, phones, badge readers, and cameras into different VLANs with ACLs or firewall rules between them.

C.Keep the design unchanged and rely on antivirus on the workstations to block access to the cameras.

D.Put all traffic through the guest Wi-Fi VLAN to isolate it from the corporate network.

AnswerB

Separating device classes into distinct VLANs creates clear trust boundaries and limits what a compromised endpoint can reach. Inter-VLAN ACLs or firewall rules can then enforce only the necessary traffic paths, such as management or service traffic. This reduces lateral movement from a workstation to sensitive building systems like cameras and badge readers.

Why this answer

Segmenting workstations, phones, badge readers, and cameras into separate VLANs with ACLs or firewall rules between them enforces micro-segmentation. This prevents a compromised workstation from directly initiating lateral movement to building systems (e.g., cameras or badge readers) by restricting inter-VLAN traffic at Layer 3/4, limiting the blast radius of an attack.

Exam trap

The trap here is that candidates often think antivirus or a flat network simplifies management, but the SY0-701 exam specifically tests the principle of network segmentation to contain lateral movement, not just endpoint protection or network simplicity.

How to eliminate wrong answers

Option A is wrong because a single flat subnet removes all network segmentation, allowing any compromised endpoint to directly communicate with any other device (including building systems) via Layer 2 broadcast or unicast, which maximizes lateral movement risk. Option C is wrong because relying solely on antivirus on workstations does not block network-level access to cameras; antivirus is a host-based detection tool that cannot prevent a compromised workstation from sending malicious traffic to other IP addresses on the same subnet. Option D is wrong because putting all traffic through the guest Wi-Fi VLAN would isolate it from the corporate network, but it would also isolate building systems from necessary management traffic and does not provide granular segmentation between different device types; it also introduces performance and policy issues for non-Wi-Fi devices.

Practice this question →

149

MCQmedium

A security architect is designing the network security for a web application hosted in a public cloud environment such as AWS. The application uses an Application Load Balancer (ALB) that distributes traffic to a fleet of web servers. The web servers must only accept traffic from the ALB, and all other inbound traffic must be blocked. The ALB itself needs to accept HTTP/HTTPS traffic from anywhere on the internet. Which of the following cloud security controls should the architect configure on the web servers' network interface to best meet this requirement, assuming the cloud provider offers both stateful and stateless network filtering options?

A.A stateless network ACL that allows inbound traffic from the ALB's subnet only.

B.A stateful security group that allows inbound traffic from the ALB's security group only.

C.A web application firewall (WAF) that inspects all traffic for SQL injection.

D.A host-based firewall on each web server that allows traffic from the ALB's private IP address.

AnswerB

Correct. Security groups are stateful and can use another security group as a source. This configuration cleanly allows only traffic originating from the ALB, automatically handles return traffic, and is the recommended cloud-native approach for controlling instance-level access.

Why this answer

A stateful security group in AWS can reference another security group as a source, allowing inbound traffic only from instances associated with the ALB's security group. This ensures that web servers accept traffic exclusively from the ALB, while the ALB itself can accept HTTP/HTTPS from the internet via its own security group rules. Stateful filtering automatically allows return traffic, simplifying rule management and meeting the requirement precisely.

Exam trap

The trap here is that candidates often confuse stateless network ACLs with stateful security groups, assuming a subnet-based ACL is sufficient, but they overlook that ACLs cannot filter by security group and require bidirectional rule management, making them unsuitable for this precise ALB-only access requirement.

Why the other options are wrong

A WAF inspects application-layer traffic for threats like SQL injection, but it does not restrict traffic sources. The requirement is to limit inbound traffic to only the ALB, which is a network access control, not a web application firewall function.

Using the ALB's private IP address is not scalable because the ALB's IP can change (e.g., after scaling or replacement), and it does not leverage the cloud provider's native security group reference, which automatically tracks the ALB's IP changes.

Practice this question →

150

MCQmedium

A security architect is designing a new data center network that will host public-facing web servers and internal application servers handling confidential employee data. The architect places the web servers in a DMZ and the internal application servers on a separate internal network segment. A stateful firewall is configured to allow inbound HTTP/HTTPS traffic from the internet to the web servers only. The firewall also permits only the web servers to initiate outbound connections to the internal application servers on a specific TCP port, and all such traffic is encrypted using TLS. Which security architecture principle is this design primarily intended to enforce?

A.Least privilege

B.Defense in depth

C.Separation of duties

D.Zero trust

AnswerB

Correct. The design uses network segmentation, firewalls, and encryption to create multiple layers of defense. This is the core concept of defense in depth, ensuring that a failure in one layer does not compromise the entire system.

Why this answer

The design enforces defense in depth by layering multiple security controls: a DMZ isolates public-facing web servers from internal networks, a stateful firewall restricts inbound traffic to HTTP/HTTPS only, and outbound connections from web servers to internal application servers are limited to a specific TCP port with TLS encryption. This layered approach ensures that even if one control fails (e.g., a web server is compromised), the attacker still faces additional barriers to reach sensitive internal systems.

Exam trap

The trap here is that candidates confuse 'defense in depth' with 'least privilege' because both involve restricting access, but defense in depth specifically refers to multiple overlapping security layers (network segmentation, firewalls, encryption) rather than minimal permissions for a single component.

Why the other options are wrong

The design restricts web servers to only initiate outbound connections to internal servers on a specific port, which is an example of least privilege, but the question asks for the primary principle. The overall architecture with multiple layers (DMZ, separate network, firewall rules, TLS) is defense in depth, not just least privilege.

The design does not separate duties among different people or roles; it separates network segments and controls traffic, which is about defense in depth, not separation of duties.

The design explicitly uses multiple layers of security (DMZ, separate internal segment, stateful firewall, TLS encryption), which is defense in depth, not zero trust. Zero trust would require continuous verification of every request regardless of network location, which is not described.

Practice this question →