CCNA Security Architecture Questions — Page 3 of 3

151

MCQmedium

Employees must sign in to several SaaS applications with corporate credentials, and terminated users should lose access quickly without manual changes in each app. Which solution best meets the requirement?

A.Create separate local usernames and passwords in each SaaS application.

B.Use federation for sign-on and automated provisioning and deprovisioning through an identity lifecycle process.

C.Require users to share one department password for each SaaS platform.

D.Store the same password in every application vault and sync it nightly.

AnswerB

Federation allows users to authenticate with the corporate identity provider, while automated provisioning helps create, update, and disable accounts across connected SaaS apps. This design supports single sign-on, faster offboarding, and centralized control over access lifecycle changes. It also reduces the risk of forgotten orphaned accounts remaining active after termination.

Why this answer

Federation enables single sign-on (SSO) using standards like SAML 2.0 or OIDC, allowing users to authenticate once with corporate credentials across multiple SaaS apps. Automated provisioning and deprovisioning via SCIM (System for Cross-domain Identity Management) ensures that when an employee is terminated, their access is revoked from all connected applications instantly without manual intervention, meeting the requirement for rapid access removal.

Exam trap

The trap here is that candidates may confuse federation with simple SSO, overlooking the automated provisioning/deprovisioning component that is essential for the 'lose access quickly' requirement, and instead pick a password-vaulting solution thinking it centralizes credentials.

How to eliminate wrong answers

Option A is wrong because creating separate local usernames and passwords in each SaaS app requires manual management for each account, making it impossible to quickly revoke access for terminated users across all apps without individual changes. Option C is wrong because sharing one department password violates the principle of least privilege and non-repudiation, as it prevents individual accountability and does not allow targeted revocation for a single terminated user. Option D is wrong because storing the same password in every application vault and syncing it nightly does not provide immediate access revocation; a terminated user could still authenticate until the next sync, and password reuse across apps increases security risk if one vault is compromised.

Practice this question →

152

MCQhard

Employees use a browser-based SaaS portal, a native expense app, and an internal API. The company wants one corporate identity, API access without separate passwords, and automatic account removal when HR disables a user. Which solution best fits?

A.Use LDAP binds directly against each application and manage local passwords separately.

B.Use OpenID Connect federation with OAuth 2.0 access tokens and SCIM provisioning.

C.Use shared local accounts in each application and sync passwords nightly from the directory.

D.Use Kerberos constrained delegation to each vendor tenant for every application.

AnswerB

OpenID Connect (OIDC) provides a federated identity layer that supports both browser-based SSO through authorization code flows and native mobile app sign-in via PKCE, while OAuth 2.0 access tokens grant the SaaS apps scoped API access on behalf of the user. SCIM (System for Cross-domain Identity Management) automates the creation, update, and deactivation of user accounts in the SaaS applications, ensuring offboarding is immediate and no orphaned accounts linger. Together they give the organization centralized lifecycle control, strong authentication, and least-privilege API access, which is the modern standard for SaaS identity management.

Why this answer

OpenID Connect (OIDC) federation with OAuth 2.0 provides a single corporate identity (federated SSO), allows API access without separate passwords (using access tokens), and SCIM provisioning automates account removal when HR disables a user. This combination meets all three requirements: unified identity, passwordless API access, and lifecycle management.

Exam trap

The trap here is that candidates often confuse LDAP or Kerberos (both legacy on-premises protocols) with modern cloud federation, failing to recognize that OIDC + OAuth 2.0 + SCIM is the only combination that provides SSO, token-based API access, and automated provisioning for SaaS and native apps.

How to eliminate wrong answers

Option A is wrong because LDAP binds require separate password management per application and do not provide API access without passwords, nor do they support automatic account removal via SCIM. Option C is wrong because shared local accounts with nightly password sync violate the requirement for a single corporate identity and do not enable API access without passwords; they also lack automatic provisioning/deprovisioning. Option D is wrong because Kerberos constrained delegation is designed for on-premises Windows environments and does not federate to browser-based SaaS or native apps, nor does it support SCIM-based lifecycle management.

Practice this question →

153

MCQeasy

A company needs a public website that anyone on the internet can reach, but the application and database servers must stay off the internet. Where should the web server be placed?

A.On the internal user network with the database server.

B.In a DMZ separated from the internal application and database networks.

C.On the same subnet as the firewall management interface.

D.Directly on the database subnet so performance is faster.

AnswerB

A DMZ is the best choice because it allows public access to the web server while keeping the application and database tiers behind additional security controls. If the web server is compromised, the attacker still has to cross another boundary to reach internal systems. This layered zoning is a standard architecture pattern for public-facing services and helps contain risk.

Why this answer

The web server must be placed in a DMZ (demilitarized zone) because this network segment is designed to host publicly accessible services while isolating them from internal networks. The DMZ allows inbound traffic from the internet to the web server, but the application and database servers remain on internal networks with strict firewall rules that block direct internet access, enforcing a layered security architecture.

Exam trap

The trap here is that candidates often confuse a DMZ with a 'public subnet' and think placing the web server directly on the internet-facing side of the firewall is sufficient, but the DMZ is a separate, isolated network segment that enforces strict traffic inspection and prevents direct lateral movement to internal resources.

How to eliminate wrong answers

Option A is wrong because placing the web server on the internal user network with the database server would expose both to direct internet traffic, violating the requirement to keep application and database servers off the internet and creating a single point of compromise. Option C is wrong because the firewall management interface subnet is a highly restricted administrative network; placing a public web server there would expose management interfaces to attack and violate security best practices. Option D is wrong because placing the web server directly on the database subnet would allow internet traffic to reach the database server directly, bypassing the application layer and defeating the purpose of network segmentation.

Practice this question →

154

MCQeasy

A company uses a SaaS file-sharing platform for employee documents. Which action is the company's responsibility, not the provider's?

A.Patching the vendor's application servers.

B.Setting user sharing permissions and access controls for company data.

C.Replacing failed disks in the provider's storage cluster.

D.Maintaining the cloud provider's identity center and hypervisor.

AnswerB

In a SaaS model, the provider manages the application and underlying infrastructure, but the customer remains responsible for how the service is used. That includes user provisioning, access permissions, sharing settings, and data handling decisions. Configuring who can see or edit documents is a customer duty because it directly affects the organization's confidentiality and compliance obligations.

Why this answer

In a SaaS model, the provider manages the underlying infrastructure, including application servers, storage, and hypervisors. The customer is responsible for configuring access controls and permissions for their own data within the application. Option B correctly identifies this shared responsibility boundary.

Exam trap

The trap here is that candidates often confuse the SaaS model with IaaS or PaaS, incorrectly assuming the customer is responsible for patching or hardware maintenance, when in fact the provider handles all infrastructure layers in SaaS.

How to eliminate wrong answers

Option A is wrong because patching the vendor's application servers is the provider's responsibility under the SaaS shared responsibility model, not the customer's. Option C is wrong because replacing failed disks in the provider's storage cluster is an infrastructure maintenance task owned by the SaaS provider. Option D is wrong because maintaining the cloud provider's identity center and hypervisor is part of the provider's responsibility for the underlying platform, not the customer's.

Practice this question →

155

MCQmedium

Based on the exhibit, which network redesign would best limit lateral movement between user endpoints and building systems after a workstation compromise?

A.Move every device into a single flat subnet so internal routing is simpler.

B.Separate workstations, phones, badge readers, and cameras into different VLANs with ACLs or firewall rules between them.

C.Keep the design unchanged and rely on antivirus on the workstations to block access to the cameras.

D.Put all traffic through the guest Wi-Fi VLAN to isolate it from the corporate network.

AnswerB

Separating device classes into distinct VLANs creates clear trust boundaries and limits what a compromised endpoint can reach. Inter-VLAN ACLs or firewall rules can then enforce only the necessary traffic paths, such as management or service traffic. This reduces lateral movement from a workstation to sensitive building systems like cameras and badge readers.

Why this answer

Segmenting workstations, phones, badge readers, and cameras into separate VLANs with ACLs or firewall rules between them enforces micro-segmentation. This prevents a compromised workstation from directly initiating lateral movement to building systems (e.g., cameras or badge readers) by restricting inter-VLAN traffic at Layer 3/4, limiting the blast radius of an attack.

Exam trap

The trap here is that candidates often think antivirus or a flat network simplifies management, but the SY0-701 exam specifically tests the principle of network segmentation to contain lateral movement, not just endpoint protection or network simplicity.

How to eliminate wrong answers

Option A is wrong because a single flat subnet removes all network segmentation, allowing any compromised endpoint to directly communicate with any other device (including building systems) via Layer 2 broadcast or unicast, which maximizes lateral movement risk. Option C is wrong because relying solely on antivirus on workstations does not block network-level access to cameras; antivirus is a host-based detection tool that cannot prevent a compromised workstation from sending malicious traffic to other IP addresses on the same subnet. Option D is wrong because putting all traffic through the guest Wi-Fi VLAN would isolate it from the corporate network, but it would also isolate building systems from necessary management traffic and does not provide granular segmentation between different device types; it also introduces performance and policy issues for non-Wi-Fi devices.

Practice this question →

156

MCQmedium

A security architect is designing the network security for a web application hosted in a public cloud environment such as AWS. The application uses an Application Load Balancer (ALB) that distributes traffic to a fleet of web servers. The web servers must only accept traffic from the ALB, and all other inbound traffic must be blocked. The ALB itself needs to accept HTTP/HTTPS traffic from anywhere on the internet. Which of the following cloud security controls should the architect configure on the web servers' network interface to best meet this requirement, assuming the cloud provider offers both stateful and stateless network filtering options?

A.A stateless network ACL that allows inbound traffic from the ALB's subnet only.

B.A stateful security group that allows inbound traffic from the ALB's security group only.

C.A web application firewall (WAF) that inspects all traffic for SQL injection.

D.A host-based firewall on each web server that allows traffic from the ALB's private IP address.

AnswerB

Correct. Security groups are stateful and can use another security group as a source. This configuration cleanly allows only traffic originating from the ALB, automatically handles return traffic, and is the recommended cloud-native approach for controlling instance-level access.

Why this answer

A stateful security group in AWS can reference another security group as a source, allowing inbound traffic only from instances associated with the ALB's security group. This ensures that web servers accept traffic exclusively from the ALB, while the ALB itself can accept HTTP/HTTPS from the internet via its own security group rules. Stateful filtering automatically allows return traffic, simplifying rule management and meeting the requirement precisely.

Exam trap

The trap here is that candidates often confuse stateless network ACLs with stateful security groups, assuming a subnet-based ACL is sufficient, but they overlook that ACLs cannot filter by security group and require bidirectional rule management, making them unsuitable for this precise ALB-only access requirement.

Why the other options are wrong

A WAF inspects application-layer traffic for threats like SQL injection, but it does not restrict traffic sources. The requirement is to limit inbound traffic to only the ALB, which is a network access control, not a web application firewall function.

Using the ALB's private IP address is not scalable because the ALB's IP can change (e.g., after scaling or replacement), and it does not leverage the cloud provider's native security group reference, which automatically tracks the ALB's IP changes.

Practice this question →

157

MCQmedium

A security architect is designing a new data center network that will host public-facing web servers and internal application servers handling confidential employee data. The architect places the web servers in a DMZ and the internal application servers on a separate internal network segment. A stateful firewall is configured to allow inbound HTTP/HTTPS traffic from the internet to the web servers only. The firewall also permits only the web servers to initiate outbound connections to the internal application servers on a specific TCP port, and all such traffic is encrypted using TLS. Which security architecture principle is this design primarily intended to enforce?

A.Least privilege

B.Defense in depth

C.Separation of duties

D.Zero trust

AnswerB

Correct. The design uses network segmentation, firewalls, and encryption to create multiple layers of defense. This is the core concept of defense in depth, ensuring that a failure in one layer does not compromise the entire system.

Why this answer

The design enforces defense in depth by layering multiple security controls: a DMZ isolates public-facing web servers from internal networks, a stateful firewall restricts inbound traffic to HTTP/HTTPS only, and outbound connections from web servers to internal application servers are limited to a specific TCP port with TLS encryption. This layered approach ensures that even if one control fails (e.g., a web server is compromised), the attacker still faces additional barriers to reach sensitive internal systems.

Exam trap

The trap here is that candidates confuse 'defense in depth' with 'least privilege' because both involve restricting access, but defense in depth specifically refers to multiple overlapping security layers (network segmentation, firewalls, encryption) rather than minimal permissions for a single component.

Why the other options are wrong

The design restricts web servers to only initiate outbound connections to internal servers on a specific port, which is an example of least privilege, but the question asks for the primary principle. The overall architecture with multiple layers (DMZ, separate network, firewall rules, TLS) is defense in depth, not just least privilege.

The design does not separate duties among different people or roles; it separates network segments and controls traffic, which is about defense in depth, not separation of duties.

The design explicitly uses multiple layers of security (DMZ, separate internal segment, stateful firewall, TLS encryption), which is defense in depth, not zero trust. Zero trust would require continuous verification of every request regardless of network location, which is not described.

Practice this question →

158

MCQhard

A stateless firewall sits between a DMZ subnet 10.10.10.0/24 and an internal subnet 10.10.20.0/24. Only the web server at 10.10.10.25 should be allowed to initiate TCP sessions to the app server at 10.10.20.20 on port 8443. All other DMZ-to-internal traffic must remain blocked. Which ACL entry is the best fit on the DMZ-facing interface?

A.deny tcp 10.10.10.0/24 10.10.20.0/24 eq 8443 followed by permit ip any any

B.permit tcp host 10.10.10.25 host 10.10.20.20 eq 8443 followed by deny ip any any

C.permit tcp host 10.10.20.20 host 10.10.10.25 eq 8443 followed by deny ip any any

D.permit ip 10.10.10.0/24 10.10.20.0/24 followed by deny ip any any

AnswerB

This rule is the least-privilege match for the stated requirement. It allows only the specific source host, destination host, and destination port needed for the application flow, while the explicit deny blocks all remaining DMZ-to-internal traffic on that interface. Because the firewall is stateless, narrowing the source and destination at the entry point is the safest way to prevent unintended exposure.

Why this answer

It explicitly permits only the web server at 10.10.10.25 to initiate TCP sessions to the app server at 10.10.20.20 on port 8443, then denies all other traffic. Since the firewall is stateless, it cannot track session state, so the ACL must be applied on the DMZ-facing interface to control outbound-initiated traffic from the DMZ to the internal subnet. The permit statement uses the 'host' keyword for precise source and destination, followed by an explicit deny all to block any other DMZ-to-internal traffic.

Exam trap

The trap here is that candidates often reverse the source and destination in the permit statement (as in Option C), mistakenly thinking the ACL should allow the app server to respond, rather than correctly permitting the web server to initiate the connection from the DMZ to the internal subnet.

How to eliminate wrong answers

Option A is wrong because it denies the specific traffic (TCP from 10.10.10.0/24 to 10.10.20.0/24 on port 8443) that should be permitted, and then permits all other traffic, which would allow unauthorized DMZ hosts to reach the internal subnet. Option C is wrong because it reverses the source and destination, permitting the app server at 10.10.20.20 to initiate sessions to the web server on port 8443, which violates the requirement that only the web server should initiate the connection. Option D is wrong because it permits all IP traffic from the entire DMZ subnet to the internal subnet, which would allow any DMZ host to reach any internal host, completely bypassing the restriction to only the web server and only on port 8443.

Practice this question →

159

MCQeasy

Employees must sign in to several cloud applications with their corporate account, and terminated users should lose access without separate password resets in each app. What is the best solution?

A.Create a separate local username and password in every cloud application.

B.Use federation with single sign-on from a central identity provider.

C.Store the same shared password in a password manager for all applications.

D.Allow each application to authenticate users only by device MAC address.

AnswerB

Federation with SSO is the best option because employees authenticate once with the corporate identity provider and then access multiple applications through trusted token exchange. This reduces password sprawl, improves user convenience, and makes offboarding faster because disabling the central account removes access across connected services. It also supports stronger controls such as MFA at the identity provider rather than repeating them in every application.

Why this answer

Federation with single sign-on (SSO) from a central identity provider (IdP) allows users to authenticate once using their corporate account, and the IdP issues security tokens (e.g., SAML assertions or OIDC tokens) that each cloud application trusts. When a user is terminated, the administrator disables the account in the IdP, and all applications immediately reject the user's tokens, eliminating the need for separate password resets in each app.

Exam trap

The trap here is that candidates confuse password managers (which store credentials but do not provide centralized revocation) with federation, or they mistakenly think MAC address authentication is viable for cloud applications, when in fact MAC addresses are link-layer identifiers not usable over the internet.

How to eliminate wrong answers

Option A is wrong because creating separate local usernames and passwords in every cloud application violates the requirement for centralized access control and would require manual password resets in each app upon termination. Option C is wrong because storing the same shared password in a password manager does not provide centralized revocation; the password would still need to be changed in every application individually to block access. Option D is wrong because authenticating by device MAC address is not feasible for cloud applications (MAC addresses are not transmitted over the internet) and does not support user-level identity or termination.

Practice this question →

160

MCQmedium

A help desk team manages 300 Windows laptops. A legacy accounting app sometimes fails after updates, so the company wants to reduce patch risk while still preventing long-term exposure. Which patching strategy is the best balance?

A.Apply updates manually to each laptop as soon as they are released.

B.Use a pilot group and phased rollout process before wider deployment.

C.Postpone all updates until the legacy accounting app is replaced.

D.Disable automatic updates permanently and patch only after a security incident.

AnswerB

A pilot-to-broad rollout strategy lets the organization validate patches on a small set of representative devices before deploying them widely. That reduces the chance of a widespread compatibility problem while still keeping systems updated on a reasonable schedule. It is a practical balance between security, reliability, and operational risk.

Why this answer

A pilot group with phased rollout lets the team validate patches against the legacy accounting app on a small subset before broad deployment, catching compatibility regressions while still meeting patch SLAs. This balances availability risk against the security risk of unpatched systems.

Exam trap

SY0-701 often tests the false dichotomy that you must choose between 'patch immediately' and 'never patch' — the correct answer is almost always a risk-balanced phased approach.

How to eliminate wrong answers

Option A is wrong because applying updates immediately to all 300 laptops with no validation maximizes the chance of breaking the legacy app and creating a widespread outage. Option C is wrong because postponing all updates until the app is replaced leaves the fleet exposed to known exploited vulnerabilities for an indefinite period. Option D is wrong because disabling updates permanently and patching only after an incident is purely reactive and guarantees compromise before remediation.

Practice this question →

161

MCQmedium

A company stores customer documents in cloud object storage. The provider already offers encryption at rest and physical security. Which action most directly reduces the risk of unauthorized access to the stored files?

A.Assume the provider's default settings are sufficient because encryption at rest is already enabled.

B.Move the documents to a public bucket so users can access them without friction.

C.Configure least-privilege IAM roles, bucket policies, and object permissions for approved users only.

D.Disable encryption at rest so administrators can troubleshoot access problems more easily.

AnswerC

In the shared responsibility model, the customer is responsible for managing access controls on the objects they store, and least privilege ensures each approved user or application receives only the permissions necessary to perform its function. This is accomplished by combining IAM roles that define a principal's allowed actions, bucket policies that restrict who can access the bucket and under what conditions (e.g., source IP or MFA), and object permissions like ACLs or condition keys that scope access to specific objects. Configuring these elements for approved users only minimizes the attack surface and helps meet compliance requirements by preventing unauthorized GetObject calls.

Why this answer

Even with encryption at rest and physical security, unauthorized access can occur if IAM policies, bucket policies, and object permissions are overly permissive. Configuring least-privilege access ensures that only approved users can read or modify the stored files, directly reducing the attack surface. Encryption at rest protects data if storage media is compromised, but it does not prevent authorized users with excessive permissions from accessing files they shouldn't.

Exam trap

The trap here is that candidates confuse encryption at rest with access control, assuming that encryption alone prevents unauthorized access, when in fact it only protects against physical theft of storage media, not against API-level access by users with excessive permissions.

How to eliminate wrong answers

Option A is wrong because assuming default settings are sufficient ignores the principle of least privilege; default IAM roles and bucket policies are often overly permissive (e.g., public read access) and must be explicitly hardened. Option B is wrong because moving documents to a public bucket would expose them to anyone on the internet, directly increasing the risk of unauthorized access. Option D is wrong because disabling encryption at rest would leave data vulnerable if an attacker gains physical access to the storage media or if the provider suffers a breach, and it does not solve access control issues.

Practice this question →

162

Multi-Selectmedium

A regulated analytics workload must run in a public cloud with the strongest practical tenant isolation while avoiding management of physical servers. The workload should also remain off the public internet. Which two deployment choices best fit? Select two.

Select 2 answers

A.Run the workload on a dedicated host or dedicated instance.

B.Place the workload in a private subnet without a public IP address.

C.Use shared tenancy with security groups only.

D.Assign an elastic IP so administrators can reach the workload directly from anywhere.

E.Expose the workload through a public load balancer to simplify connectivity.

AnswersA, B

Dedicated compute placement provides stronger tenant isolation than shared hardware and is appropriate when a regulated workload needs a higher separation level. It also keeps the organization in a cloud model without requiring ownership of physical servers.

Why this answer

A dedicated host or dedicated instance provides the strongest practical tenant isolation in a public cloud by ensuring that the underlying physical server is not shared with any other customer. This meets the regulatory requirement for strong isolation while avoiding the need to manage physical servers, as the cloud provider still handles hardware maintenance. The dedicated instance model (e.g., AWS Dedicated Instances) offers hardware-level isolation at the instance level, while a dedicated host gives you visibility and control over the physical server, both without requiring you to manage the server itself.

Exam trap

The trap here is that candidates often confuse network isolation (private subnet) with tenant isolation (physical hardware separation), or they assume that a public load balancer can be used without exposing the workload to the internet, forgetting that the load balancer itself has a public endpoint.

Practice this question →

163

Multi-Selecteasy

A company wants employees to sign in once with corporate credentials and access multiple SaaS apps without creating separate passwords for each service. Which two features best support this goal? Select two.

Select 2 answers

A.Federation trust between the corporate identity provider and the SaaS provider.

B.Single sign-on so users authenticate once and reuse that session across apps.

C.Shared generic accounts for each department.

D.Storing the same password inside every SaaS application.

E.Disabling MFA so the sign-in process is faster.

AnswersA, B

Federation trust is a technical relationship established between the corporate identity provider (IdP) and the SaaS provider's service (SP), often via standards like SAML 2.0 or OIDC. The SP relies on security assertions/tokens issued by the IdP, eliminating the need for separate accounts or passwords in the SaaS application. This enables centralized identity governance, immediate revocation when an employee leaves, and a single compliant authentication policy across all connected services.

Why this answer

Federation trust, typically implemented via standards like SAML 2.0 or OpenID Connect, establishes a trust relationship between the corporate identity provider (IdP) and each SaaS provider. This allows the SaaS app to accept authentication assertions from the corporate IdP, enabling users to sign in with their corporate credentials without needing separate passwords for each service.

Exam trap

The trap here is that candidates may confuse SSO (Option B) with federation (Option A) as being redundant, but they are complementary—federation establishes the trust relationship, while SSO provides the seamless session reuse—so both are required to meet the goal of signing in once with corporate credentials across multiple SaaS apps.

Practice this question →

164

Matchinghard

Match each design requirement to the best security architecture control. Use each control once.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

DMZ

Bastion host

Microsegmentation

Zero Trust Network Access (ZTNA)

Load balancer

Why these pairings

Defense in depth uses layered controls, least privilege minimizes risk, separation of duties prevents fraud, fail secure avoids insecure states, secure defaults reduce misconfiguration, and complete mediation ensures consistent enforcement.

Practice this question →

165

MCQmedium

An HR system marks employees as hired, transferred, or terminated. The security team wants those changes to create, update, or disable accounts in multiple SaaS apps automatically after the user authenticates through the company identity provider. Which capability should be added?

A.SAML federation alone, with no additional account lifecycle automation.

B.Password synchronization between every application.

C.SCIM provisioning integrated with the SSO platform.

D.Local administrator groups on each SaaS application.

AnswerC

SCIM provisioning integrated with the SSO platform provides a standard REST-based API for automatically creating, updating, and disabling user accounts when HR marks employees as hired, transferred, or terminated. The HR system becomes the authoritative source, and the SSO platform propagates those lifecycle events to all connected applications in near real time. This enables centralized, auditable, and consistent identity lifecycle management across SaaS apps.

Why this answer

SCIM (System for Cross-domain Identity Management) is the correct choice because it provides a standardized protocol for automating the creation, update, and deletion of user accounts across multiple SaaS applications. When integrated with an SSO platform (like SAML), SCIM handles the lifecycle events (hire, transfer, terminate) by sending RESTful API calls to each SaaS app, ensuring accounts are created, updated, or disabled without manual intervention. SAML alone only handles authentication, not account provisioning, making SCIM essential for the described automation.

Exam trap

The trap here is that candidates often confuse SAML federation (which only handles authentication) with full identity lifecycle management, leading them to pick option A, but the question explicitly requires automated account creation, update, and disablement—a capability only SCIM provides.

How to eliminate wrong answers

Option A is wrong because SAML federation alone only handles authentication (single sign-on) and does not include any account lifecycle management—it cannot create, update, or disable accounts automatically. Option B is wrong because password synchronization between applications is a legacy approach that does not automate account provisioning or deprovisioning; it only keeps passwords consistent and introduces security risks without addressing the core requirement of lifecycle automation. Option D is wrong because local administrator groups on each SaaS application are a manual, per-application access control mechanism that does not provide any automated account lifecycle management or integration with the identity provider.

Practice this question →

166

MCQmedium

A company moved an internal application to a cloud virtual machine. The security team wants operating system login events, process activity, and network flow metadata to be available in the SIEM for investigations. Which action best supports that goal?

A.Rely only on the cloud provider's service health dashboard and billing alerts.

B.Enable guest OS audit logging and cloud-native flow logs, then forward the data to the SIEM.

C.Encrypt the virtual machine disks and disable all logging to reduce exposure.

D.Install only a web application firewall because that covers server log collection.

AnswerB

This combines host-level visibility with cloud network telemetry. Audit logs capture logons and system activity inside the virtual machine, while flow logs show network connections. Forwarding both to a SIEM gives analysts the context needed to correlate suspicious behavior across layers.

Why this answer

It directly addresses the requirement to collect operating system login events, process activity, and network flow metadata. Enabling guest OS audit logging (e.g., via Windows Event Log or syslog) captures login and process events, while cloud-native flow logs (e.g., AWS VPC Flow Logs or Azure NSG flow logs) provide network flow metadata. Forwarding both data streams to the SIEM ensures centralized visibility for investigations.

Exam trap

The trap here is that candidates may think cloud provider dashboards or encryption are sufficient for security monitoring, but they fail to recognize that the specific data types required (OS events and network flows) must be explicitly enabled and forwarded from the guest OS and network layer, not inferred from provider-level metrics.

How to eliminate wrong answers

Option A is wrong because relying solely on the cloud provider's service health dashboard and billing alerts provides only infrastructure-level availability and cost data, not the required OS login events, process activity, or network flow metadata. Option C is wrong because encrypting disks and disabling all logging would eliminate the very data needed for investigations, directly contradicting the goal of making that data available in the SIEM.

Practice this question →

167

MCQeasy

Field staff use company-owned tablets that also run approved personal apps. Security wants corporate email and documents separated from personal data, with the ability to wipe only the work data if a device is lost. What is the best control?

A.Use a work profile or container managed by a mobile device management platform.

B.Disable all personal apps by removing internet access from the tablet.

C.Install only a screen lock and require a longer PIN for the tablet.

D.Use a USB cable lock so the tablet cannot be physically moved.

AnswerA

A managed work profile or container is the best answer because it separates corporate data from personal applications on the same mobile device. That allows the organization to enforce policies on work data, protect corporate email and documents, and selectively remove only the business container if the tablet is lost or the user leaves. It supports a practical BYOD or COPE style deployment without wiping the user's personal content.

Why this answer

A work profile or container managed by a mobile device management (MDM) platform creates a separate, encrypted partition on the device for corporate data. This allows the organization to enforce policies and perform a selective wipe of only the work container without affecting personal apps or data, meeting the requirement for separation and targeted remote wipe.

Exam trap

The trap here is that candidates may think a screen lock or disabling internet is sufficient for data separation, but the exam specifically tests the concept of containerization and selective wipe as the only method that meets both separation and targeted data removal requirements.

How to eliminate wrong answers

Option B is wrong because disabling internet access on the tablet would block all network connectivity, preventing both personal and corporate apps from functioning, and does not provide any data separation or selective wipe capability. Option C is wrong because a screen lock and longer PIN only protect the device from unauthorized access at rest; they do not separate corporate data from personal data, nor do they enable a selective wipe of work data only.

Practice this question →

168

MCQmedium

A company manages 300 laptops and wants to reduce risk from missed patches while avoiding a widespread outage if an update has compatibility issues. Which patching approach is the best choice?

A.Install patches manually on each laptop after users report problems.

B.Deploy all patches to every laptop immediately with no testing.

C.Use a phased rollout with a pilot group, then expand deployment after validation, while keeping a standard baseline configuration.

D.Wait for annual maintenance windows so all changes happen at once.

AnswerC

A phased or ring-based rollout balances speed and stability. A pilot group catches compatibility issues early, and the baseline keeps endpoint settings consistent across the fleet. This approach reduces risk from vulnerabilities without creating unnecessary operational disruption.

Why this answer

A phased rollout with a pilot group allows the IT team to validate patches on a small subset of laptops before full deployment, reducing the risk of widespread outages from compatibility issues. Maintaining a standard baseline configuration ensures consistency across all 300 laptops, which simplifies patch management and reduces the likelihood of missed patches. This approach balances risk mitigation with operational continuity, aligning with best practices for enterprise patch management.

Exam trap

The trap here is that candidates may choose Option B (immediate deployment) because they prioritize speed and simplicity over risk management, failing to recognize that unvalidated patches can cause cascading failures that negate any security benefits.

How to eliminate wrong answers

Option A is wrong because installing patches manually only after users report problems is a reactive approach that leaves laptops vulnerable to known exploits for extended periods, increasing the risk of security breaches. Option B is wrong because deploying all patches to every laptop immediately with no testing ignores the potential for compatibility issues that could cause widespread outages, application failures, or system instability across the entire fleet.

Practice this question →

169

MCQmedium

Employees use several SaaS applications, and the security team wants one corporate login, MFA for unmanaged devices, and centralized account provisioning. Which architecture should be used?

A.Create separate usernames and passwords for each SaaS application.

B.Use federated single sign-on with the corporate identity provider and conditional access policies.

C.Share one generic account for the team so access is easier to audit.

D.Put all users on a VPN and let each SaaS application trust the internal network automatically.

AnswerB

Federated single sign-on with the corporate identity provider lets users authenticate once—typically with MFA—and receive a SAML or OIDC assertion that each SaaS application trusts. Conditional access policies evaluate real-time signals such as user risk, device compliance, or geolocation before issuing the token, enabling dynamic controls like blocking unmanaged devices or requiring step-up authentication. This approach centralizes identity lifecycle management and enforces uniform security policy across every connected application.

Why this answer

Federated single sign-on (SSO) with a corporate identity provider (IdP) allows users to authenticate once using their corporate credentials and access multiple SaaS applications without separate logins. Conditional access policies can enforce MFA specifically for unmanaged devices, and centralized account provisioning (e.g., via SCIM) ensures accounts are created, updated, and deprovisioned from a single directory. This architecture meets all three requirements: single corporate login, MFA for unmanaged devices, and centralized provisioning.

Exam trap

The trap here is that candidates confuse network-level controls (VPN) with identity-level controls (federation), assuming that a VPN provides the same authentication and authorization granularity as SSO with conditional access.

How to eliminate wrong answers

Option A is wrong because creating separate usernames and passwords for each SaaS application violates the requirement for a single corporate login, increases password fatigue, and makes centralized provisioning impossible. Option C is wrong because sharing one generic account eliminates individual accountability, violates the principle of least privilege, and makes auditing impossible since actions cannot be traced to a specific user. Option D is wrong because VPNs only provide network-level access and do not integrate with SaaS application authentication; SaaS apps cannot 'trust the internal network automatically' without federation, and VPNs do not enforce MFA or provide centralized account provisioning.

Practice this question →

170

MCQhard

Administrators must manage network switches from home. Requirements: encrypted management traffic, MFA for users, no management ports exposed to the Internet, and centralized logging of admin sessions. Which solution best meets the requirements?

A.Open SSH directly on each switch and allow access from the entire Internet.

B.Use a VPN with MFA that terminates on a hardened jump host, then reach switches over SSH or HTTPS.

C.Use port forwarding through the firewall to RDP on each switch.

D.Build an IPSec tunnel only between office routers and share a common admin password on the switches.

AnswerB

A VPN with MFA that terminates on a hardened jump host provides authenticated, encrypted remote access while ensuring switch management protocols are never exposed directly to the internet. The jump host acts as a controlled pivot point, so administrators reach switches only via SSH or HTTPS after passing both the VPN and MFA, and it centralizes logging and auditing of management sessions.

Why this answer

It satisfies all requirements: a VPN with MFA encrypts management traffic, the hardened jump host provides a secure intermediary that keeps switch management ports off the Internet, and centralized logging can be implemented on the jump host to record all admin sessions. This architecture aligns with the principle of defense-in-depth by combining encrypted tunnels, strong authentication, and network segmentation.

Exam trap

The trap here is that candidates may think a VPN alone is sufficient, forgetting that the jump host is necessary to avoid exposing switch management ports and to enable centralized logging and MFA enforcement.

How to eliminate wrong answers

Option A is wrong because opening SSH directly on each switch from the entire Internet exposes management ports to the public, violating the requirement that no management ports be exposed to the Internet, and it lacks MFA. Option C is wrong because port forwarding RDP to each switch exposes management ports (RDP uses port 3389) to the Internet, and RDP is not the native management protocol for network switches (switches typically use SSH or HTTPS), nor does it inherently provide MFA or centralized logging. Option D is wrong because an IPSec tunnel between office routers does not address MFA (it uses a shared common password, which is weak), and it does not provide centralized logging of admin sessions.

Practice this question →

171

MCQmedium

A DevOps team builds container images in a CI/CD pipeline. Security wants to reduce the chance of deploying vulnerable libraries and also wants the cluster to reject images that have not been approved. Which approach best meets both requirements?

A.Increase CPU and memory limits for the containers so they run more safely.

B.Allow developers to pull images from any registry as long as the tags look familiar.

C.Disable pipeline scanning to speed releases and rely on runtime monitoring after deployment.

D.Scan images in the pipeline and enforce signature verification or admission control before deployment.

AnswerD

Build-time scanning helps identify vulnerable packages before release, while signature verification or admission control ensures only approved images can run in the cluster. Together, these controls reduce both content risk and deployment risk. This is the strongest combined answer because it addresses prevention and policy enforcement.

Why this answer

It combines two essential security controls: scanning container images for known vulnerabilities (e.g., using Trivy or Clair) during the CI/CD pipeline, and enforcing signature verification (e.g., using Notary or Cosign) or admission control (e.g., using OPA/Gatekeeper or Kyverno) to ensure only signed or approved images are deployed. This directly reduces the risk of deploying vulnerable libraries and prevents unapproved images from running in the cluster.

Exam trap

The trap here is that candidates may think runtime monitoring (Option C) is sufficient, but it fails to prevent the initial deployment of vulnerable or unapproved images, which is the core requirement of the question.

How to eliminate wrong answers

Option A is wrong because increasing CPU and memory limits does not address vulnerability scanning or image approval; it only affects runtime resource allocation, not security posture. Option B is wrong because allowing images from any registry based on tag familiarity is insecure—tags can be easily spoofed or overwritten, and this bypasses any approval or integrity verification. Option C is wrong because disabling pipeline scanning removes the vulnerability detection step entirely, and relying solely on runtime monitoring cannot prevent the initial deployment of vulnerable or unapproved images.

Practice this question →

172

MCQhard

A team stores sensitive archives on cloud block storage. The provider already encrypts disks at rest, but the company wants copies of the disks to remain unreadable even if a cloud administrator can snapshot and mount the volume. Which control is best?

A.Enable provider-managed encryption at rest only and rotate the storage passwords monthly.

B.Use client-side encryption before upload and keep the keys in an external HSM or key service.

C.Place the storage account in a private subnet and block all Internet access.

D.Rely on immutable snapshots and versioning to prevent unauthorized access.

AnswerB

Client-side encryption means the data is encrypted by your own application or tooling before any bytes are transmitted to the provider, so the provider never receives plaintext or the encryption keys. Keeping the keys in an external HSM or key service (separate from the cloud account) ensures that even if the storage account, snapshots, or mounted disks are copied or accessed by the provider's administrators, the ciphertext remains unreadable without the externally held keys. This achieves a zero-knowledge architecture where the provider cannot decrypt the data, directly addressing the risk of unauthorized administrative access to the cloud storage platform.

Why this answer

Client-side encryption ensures data is encrypted before it ever reaches the cloud provider's storage. By keeping the encryption keys in an external HSM or key service, the cloud provider (including its administrators) never has access to the plaintext keys, so even if they snapshot and mount the volume, the data remains unreadable. This addresses the threat model where the provider's own administrators could otherwise access the data at rest.

Exam trap

The trap here is that candidates assume provider-managed encryption at rest is sufficient against insider threats, but it does not protect against a cloud administrator who has access to the underlying infrastructure and can use snapshot/mount operations to bypass the encryption layer.

How to eliminate wrong answers

Option A is wrong because provider-managed encryption at rest still gives the cloud provider access to the encryption keys (or the means to decrypt), so a cloud administrator with snapshot and mount privileges could read the data. Rotating storage passwords does not change this fundamental access issue. Option C is wrong because placing the storage account in a private subnet and blocking Internet access only restricts network-level access; it does not prevent a cloud administrator from taking a snapshot and mounting it internally, nor does it encrypt the data to protect against that insider threat.

Practice this question →

173

MCQmedium

A security architect at a retail company is deploying a new e-commerce platform that processes credit card payments. The architect needs to minimize the scope of the PCI DSS assessment. The platform consists of a web server, an application server, and a database server. The cardholder data (credit card numbers) will be processed and stored only on the database server. Which of the following network architecture designs would best reduce the PCI DSS scope?

A.Place all servers in the same VLAN and apply a host-based firewall on the database server.

B.Place the database server in a separate, isolated network segment with a dedicated firewall that blocks all traffic except from the application server on the required port.

C.Encrypt all data in transit using TLS and at rest using AES-256.

D.Implement network intrusion detection systems on all network segments.

AnswerB

This design creates a clear cardholder data environment (CDE) boundary. The dedicated firewall restricts access so only the application server can communicate with the database server on a specific port. The web server and application server can be placed outside the CDE if they do not directly transmit or store cardholder data, thereby reducing the PCI DSS scope.

Why this answer

Isolating the database server in a separate network segment with a dedicated firewall that restricts traffic to only the application server on the required port creates a clear network segmentation boundary. This segmentation limits the cardholder data environment (CDE) to just the database server, thereby minimizing the scope of the PCI DSS assessment by excluding the web and application servers from the CDE.

Exam trap

The trap here is that candidates often confuse security controls (encryption, IDS) with architectural segmentation, mistakenly believing that encryption or monitoring alone can reduce PCI DSS scope, when only network isolation with a firewall boundary achieves that.

Why the other options are wrong

Placing all servers in the same VLAN does not isolate the database server, so the entire network segment is in scope for PCI DSS. A host-based firewall on the database server alone does not reduce the network segmentation required to minimize scope.

Encryption protects data confidentiality but does not isolate the database server from the rest of the network; PCI DSS scope is determined by network segmentation, not encryption. Without segmentation, all servers are in scope.

Implementing network intrusion detection systems (NIDS) does not reduce the scope of PCI DSS assessment because scope is determined by the systems that store, process, or transmit cardholder data, not by security controls like NIDS.

Practice this question →

174

Multi-Selecteasy

A security team wants to reduce the chance that employees boot unmanaged tools from removable media and wants only approved software to run on laptops. Which two controls should they use? Select two.

Select 2 answers

A.Secure Boot

B.Application control or allowlisting

C.DNS forwarding

D.Longer screen-lock timeout

E.Public DNS resolvers

AnswersA, B

Secure Boot helps ensure the device starts using trusted boot components instead of unapproved pre-boot code. That reduces the risk of tampered boot media or rogue recovery tools.

Why this answer

Secure Boot is correct because it ensures that only signed, trusted firmware and bootloaders execute during system startup, preventing unauthorized bootable media (e.g., USB drives with unmanaged OS images) from loading. This directly reduces the chance that employees can boot unmanaged tools from removable media by enforcing a chain of trust from UEFI firmware to the operating system kernel.

Exam trap

The trap here is that candidates may confuse DNS forwarding (a network service) with DNS filtering or security controls, or think that a longer screen-lock timeout improves security, when in fact it weakens physical security by extending the window of opportunity for unauthorized access.

Practice this question →

175

MCQmedium

A branch office has users, finance workstations, printers, and IP phones on one flat LAN. After a malware outbreak on a user PC, management wants to limit lateral movement without blocking printing or voice traffic. What should the network team implement?

A.Move all devices into one larger subnet and rely on endpoint antivirus for separation.

B.Create separate VLANs for device groups and apply inter-VLAN ACLs that permit only required traffic.

C.Place all devices behind a single proxy server and block all internal east-west traffic.

D.Enable port security on the switch and disable all VLAN tagging to reduce complexity.

AnswerB

Segmenting the flat LAN into VLANs by device role, then enforcing inter-VLAN ACLs that permit only required flows, contains lateral movement while preserving printing and voice. This satisfies management's constraint of restricting spread without disrupting legitimate services.

Why this answer

Segmenting devices into separate VLANs (e.g., users, finance, printers, IP phones) and applying inter-VLAN ACLs restricts lateral movement by default while permitting only necessary traffic like printing (TCP 9100) and voice (RTP/UDP 16384-32767). This aligns with the principle of least privilege and zero trust segmentation, preventing malware from spreading across the flat LAN without disrupting critical services.

Exam trap

The trap here is that candidates often confuse 'limiting lateral movement' with 'blocking all east-west traffic,' forgetting that printing and voice require specific peer-to-peer flows that a proxy or full-block would break.

How to eliminate wrong answers

Option A is wrong because moving all devices into one larger subnet increases the attack surface and does nothing to limit lateral movement; endpoint antivirus alone cannot prevent east-west propagation. Option C is wrong because placing all devices behind a single proxy server blocks east-west traffic entirely, which would break local printing (direct IPP/SMB) and voice (RTP) traffic that requires direct peer-to-peer communication. Option D is wrong because enabling port security only controls MAC address flooding and disabling VLAN tagging would collapse all traffic into a single broadcast domain, eliminating segmentation and increasing lateral movement risk.

Practice this question →

176

MCQmedium

Field technicians use company-owned tablets that also run approved personal apps. Security needs corporate email and documents isolated from personal data, selective wipe of only business content if a device is lost, and compliance checks before access is allowed. What should be deployed?

A.Full-disk encryption on the tablets with no additional device management.

B.Mobile device management with a work profile or container and conditional access.

C.A mobile VPN client with split tunneling enabled for user convenience.

D.An antivirus app with a blacklist of approved and unapproved mobile apps.

AnswerB

Mobile device management (MDM) with a work profile or container creates a hard logical separation between corporate data and personal apps on the same tablet. Conditional access policies can then require device compliance (such as patch level, root/jailbreak status, and lock screen strength) before granting access to corporate email or internal applications. This architecture allows IT to selectively wipe only the managed corporate container without touching personal data, and to enforce app-level restrictions. Together, containerization and conditional access directly address the need to manage company-owned tablets that also serve personal use, unlike encryption, VPN, or antivirus alone.

Why this answer

Mobile device management (MDM) with a work profile or container (e.g., Android Work Profile or iOS Managed Open In) provides the required isolation between corporate and personal data. Conditional access enforces compliance checks (e.g., device health attestation, OS patch level) before granting access to corporate resources. This combination also enables selective wipe of only the work container without affecting personal apps or data, meeting the lost-device requirement.

Exam trap

The trap here is that candidates confuse full-disk encryption (which only protects data at rest) with the isolation and selective-wipe capabilities of a managed work profile, or they assume a VPN or antivirus alone can enforce data separation and compliance checks.

How to eliminate wrong answers

Option A is wrong because full-disk encryption protects data at rest but does not isolate corporate from personal data, nor does it support selective wipe or compliance-based access control. Option C is wrong because a mobile VPN with split tunneling only controls network routing for user convenience; it provides no data isolation, no selective wipe capability, and no compliance enforcement. Option D is wrong because an antivirus app with an app blacklist only blocks or allows specific applications; it cannot isolate corporate data, perform selective wipes, or enforce compliance checks before access.

Practice this question →

177

Multi-Selectmedium

A finance workflow currently lets one employee create a payment batch and approve it in the same session. Audit findings say the design increases fraud risk. Which two access architecture changes best reduce that risk while keeping the process functional? Select two.

Select 2 answers

A.Split the workflow into separate creator and approver roles.

B.Require the approver to be a different authenticated user before release.

C.Grant all finance users local administrator rights to speed up exception handling.

D.Store the payment password in a shared mailbox so the team can continue when someone is absent.

E.Remove approval steps entirely and rely on log reviews after payment runs.

AnswersA, B

Separating creator and approver responsibilities implements separation of duties and prevents one person from completing the full fraud-prone action alone. This preserves the workflow while requiring a second trusted person to review and approve the batch. It is a classic access architecture control for payment and procurement systems.

Why this answer

Implementing separation of duties (SoD) by splitting the payment batch creation and approval into distinct roles ensures that no single user can both create and approve a transaction. This directly mitigates the fraud risk identified in the audit by requiring collusion between two users to execute a fraudulent payment. The process remains functional because the workflow is simply reordered into two sequential steps performed by different users.

Exam trap

The trap here is that candidates may confuse 'functional efficiency' with 'security best practices' and incorrectly choose option C, thinking that local admin rights will speed up exception handling, when in fact it violates least privilege and separation of duties.

Practice this question →

178

MCQmedium

A customer portal runs from a primary data center. Management wants the secondary site to take over within minutes if the primary site loses power, and the secondary site should already have current systems and data ready to serve users. Which design best fits this requirement?

A.A cold site with nightly backups stored offsite

B.A hot site with synchronized data replication and automated failover

C.RAID 0 across two storage arrays in the primary data center

D.A single backup server with larger disks and more memory

AnswerB

A hot site is already prepared to operate and can receive traffic quickly when the primary site fails. Synchronized replication keeps data current, and automated failover minimizes manual intervention and recovery time. This is the best match for a near-immediate continuity requirement.

Why this answer

A hot site with synchronized data replication and automated failover is the correct choice because it maintains an exact, real-time copy of systems and data at the secondary site. Synchronous replication ensures zero data loss (RPO=0), and automated failover enables the secondary site to become operational within minutes (RTO measured in minutes), meeting the requirement for immediate takeover after a power loss at the primary site.

Exam trap

The trap here is that candidates confuse a cold site with nightly backups as sufficient for rapid recovery, failing to recognize that the RTO of minutes requires pre-staged, synchronized systems and automated failover, not manual restoration from backups.

How to eliminate wrong answers

Option A is wrong because a cold site has no pre-installed hardware or current data; it requires manual setup and restoration from nightly backups, which takes hours or days, not minutes, and cannot achieve the required RTO. Option C is wrong because RAID 0 provides striping for performance but offers no fault tolerance; if either array fails, all data is lost, and it does not address site-level failover or power loss at the primary data center.

Practice this question →

179

MCQmedium

Sales representatives use company-managed smartphones for email, CRM, and document access. If a phone is lost, IT must remove only the corporate apps and work data without erasing the employee's personal photos and contacts. Which control should be used?

A.Perform a full factory reset remotely as soon as any device is reported lost.

B.Use selective wipe through a mobile device management platform.

C.Disable password complexity so the user can regain access more easily after replacement.

D.Install a VPN profile and assume corporate data is safe if the network traffic is encrypted.

AnswerB

Selective wipe, executed through an MDM platform, targets only the corporate container or managed objects on the device, including work email, calendar, VPN profiles, certificates, and managed applications. Because personal data remains intact, this approach aligns with BYOD and COPE deployment models where users retain a privacy expectation. The remote administrative action also supports immediate response to a lost device without the collateral damage of a full factory reset.

Why this answer

Mobile Device Management (MDM) platforms support selective wipe, which uses management APIs (e.g., Android Enterprise Work Profile or iOS Managed Open In) to remove only corporate apps, accounts, and data while leaving personal content intact. This satisfies the requirement to protect corporate data without infringing on the employee's personal privacy.

Exam trap

The trap here is that candidates often confuse full factory reset (option A) with selective wipe, assuming any remote wipe will suffice, but the exam specifically tests the distinction between wiping all data versus only corporate-managed data.

How to eliminate wrong answers

Option A is wrong because a full factory reset erases all data on the device, including personal photos and contacts, which violates the requirement to preserve personal data. Option C is wrong because disabling password complexity weakens device security and does not address the need to selectively remove corporate data; it also does not help regain access after replacement. Option D is wrong because installing a VPN profile only encrypts network traffic in transit and does not provide any mechanism to remotely remove corporate data from a lost device.

Practice this question →

180

Multi-Selecteasy

Company-owned tablets run both business apps and approved personal apps. Which two controls best keep company data separated and support selective wipe? Select two.

Select 2 answers

A.Mobile device management with a work profile or container for corporate data.

B.Selective remote wipe of only the managed corporate container.

C.Allow users to install any app if they promise not to open work files.

D.Store corporate files in the personal photo gallery for easier backup.

E.Disable screen locks so users can access business apps faster.

AnswersA, B

A mobile device management (MDM) work profile—such as Android Enterprise work profile or iOS managed app configuration—creates a cryptographically isolated container where corporate data, apps, and policies are managed separately from the personal environment. The container enforces its own PIN policy, encryption, app allowlisting, and traffic routing rules, so business data remains protected even on a shared device. This is the foundational control because it enables centralized administration without infringing on the user's personal apps and data.

Why this answer

Mobile Device Management (MDM) with a work profile or container creates a separate, encrypted partition on the device for corporate data. This container enforces policies (e.g., app whitelisting, VPN) and isolates business apps from personal apps, ensuring that company data remains protected even if the personal side is compromised.

Exam trap

The trap here is that candidates may confuse 'selective wipe' with a full device wipe, or assume that user promises (Option C) or convenience features (Option E) are acceptable security controls, when only containerization and managed wipe satisfy the separation and selective wipe requirements.

Practice this question →

181

Multi-Selecteasy

A small company is deploying a public web application with a front-end server, an application server, and a database. Which two design choices best reduce exposure of the backend systems? Select two.

Select 2 answers

A.Place the web server in a DMZ that is reachable from the internet.

B.Put the database on the same subnet as the web server for faster communication.

C.Place the database on an internal subnet that is not directly reachable from the internet.

D.Allow every tier to communicate freely to simplify troubleshooting.

E.Use one flat VLAN for all three servers and rely on strong passwords.

AnswersA, C

The web server is the system that must face external traffic, so placing it in a DMZ keeps it separate from internal resources. This limits the damage if the public server is compromised.

Why this answer

Placing the web server in a DMZ (demilitarized zone) allows it to be reachable from the internet while isolating it from the internal network. This design ensures that even if the web server is compromised, an attacker cannot directly access the application server or database, as traffic must pass through a firewall with strict rules. The DMZ acts as a buffer zone, reducing the attack surface of backend systems.

Exam trap

CompTIA often tests the misconception that placing all servers in a single VLAN with strong passwords is sufficient security, but the trap here is that network segmentation (DMZ and internal subnets) is essential to limit lateral movement, and passwords alone cannot stop an attacker who exploits a vulnerability in the web server.

Practice this question →

182

MCQmedium

A development team is moving a regulated application to a cloud platform. The security architect wants the strongest practical separation from other customers without buying and operating physical servers. Which hosting option is most appropriate?

A.A shared multi-tenant environment with no additional security configuration.

B.A dedicated host or isolated compute offering from the cloud provider.

C.Any public object storage service because the data will be encrypted by default.

D.A remote desktop service on the cheapest shared instance available.

AnswerB

A dedicated or isolated compute option provides stronger separation from other tenants while avoiding the need to manage physical hardware directly. It is a common architecture choice for regulated workloads that need enhanced tenant isolation, clearer placement controls, and a stronger compliance story than a standard shared environment.

Why this answer

A dedicated host or isolated compute offering (option B) provides the strongest practical separation because it ensures the application runs on a physical server dedicated solely to that customer, preventing any resource sharing or potential side-channel attacks from other tenants. This meets the regulatory requirement for strong isolation without the cost and operational overhead of purchasing and managing physical servers on-premises.

Exam trap

The trap here is that candidates often confuse 'dedicated host' with 'dedicated instance' or assume a shared multi-tenant environment can be secured solely with encryption, overlooking the need for physical isolation in regulated workloads.

How to eliminate wrong answers

Option A is wrong because a shared multi-tenant environment with no additional security configuration offers weak isolation, as other customers' virtual machines may run on the same hypervisor, increasing the risk of data exposure or side-channel attacks. Option C is wrong because public object storage services are not a compute hosting option; they are for storing data, not running applications, and encryption by default does not address the need for compute-level separation. Option D is wrong because a remote desktop service on the cheapest shared instance provides no dedicated hardware or strong isolation, and the instance is still shared with other tenants, failing to meet the required separation.

Practice this question →

183

MCQmedium

Based on the exhibit, which integration best lets the SaaS application trust the company's existing identity provider so users can sign in with their corporate credentials?

A.Establish SAML federation so the SaaS app trusts the corporate identity provider.

B.Enable password synchronization so the SaaS app stores the same password as the directory.

C.Create a shared local administrator account for all subsidiary users.

D.Configure MAC address filtering on company laptops to allow portal access.

AnswerA

SAML 2.0 federation establishes the SaaS application as a service provider that trusts the corporate identity provider (IdP). When a user attempts to access the SaaS app, the app redirects them to the IdP, which authenticates them against the corporate directory and issues a digitally signed XML assertion. The SaaS app verifies the signature and grants session access, so users never need a separate SaaS password and account provisioning can be centrally managed.

Why this answer

SAML (Security Assertion Markup Language) federation allows the SaaS application to trust the corporate identity provider (IdP) by exchanging signed XML assertions. This enables users to authenticate against their corporate credentials without the SaaS app ever storing or managing those credentials, providing single sign-on (SSO) across domains.

Exam trap

The trap here is that candidates confuse password synchronization (a legacy or on-premises approach) with federation (SAML), thinking that syncing passwords achieves the same 'trust' without realizing it requires the SaaS app to handle credentials directly, which is less secure and not true federation.

How to eliminate wrong answers

Option B is wrong because password synchronization replicates the password hash to the SaaS app, which still requires the app to store and manage credentials, violating the principle of federated trust and increasing the attack surface. Option C is wrong because creating a shared local administrator account violates the principle of least privilege and non-repudiation, as it cannot tie actions to individual users and poses a massive security risk. Option D is wrong because MAC address filtering is a network access control mechanism that restricts which devices can connect to the network; it does not provide identity-based authentication or trust between the SaaS app and the corporate IdP.

Practice this question →

184

MCQmedium

Based on the exhibit, which action best addresses both the unsanctioned software problem and the need for consistent endpoint configuration? Exhibit: Device group: Sales-Laptops Baseline check: - Approved browser: installed - Approved EDR: installed - Unapproved remote admin tool: detected on 14 endpoints - Local administrator rights: granted to all users in group - Patch compliance: 68% Management wants to prevent unauthorized software from running and keep future builds consistent.

A.Deploy application allowlisting through centralized endpoint management and remove local administrator rights.

B.Keep users as local admins but require stronger email passwords for better overall security.

C.Disable the EDR agent during software installs to avoid false alerts from approved apps.

D.Store approved installers on a shared drive and let users choose what to install.

AnswerA

Application allowlisting is the best fit because it prevents unapproved tools from executing even if they are present on a device. Removing local administrator rights also reduces the chance that users can install or alter software outside the baseline. Combined, these controls support consistent endpoint hardening and make it much harder for risky utilities to appear across the fleet.

Why this answer

Application allowlisting (via AppLocker or Windows Defender Application Control) centrally enforces which software can run, directly addressing the unsanctioned remote admin tool. Removing local administrator rights prevents users from bypassing the allowlist or making unauthorized configuration changes, ensuring consistent endpoint builds and improving patch compliance by limiting user-driven modifications.

Exam trap

The trap here is that candidates may think removing admin rights alone is sufficient, but without application allowlisting, users can still run unapproved software from writable directories like AppData or Temp, so both controls are needed together.

How to eliminate wrong answers

Option B is wrong because keeping users as local admins perpetuates the root cause of unsanctioned software installation and inconsistent configurations, and stronger email passwords do not prevent unauthorized software execution. Option C is wrong because disabling the EDR agent during installs would allow malicious software to run undetected, violating the requirement to prevent unauthorized software and undermining endpoint security. Option D is wrong because storing installers on a shared drive and letting users choose what to install does not enforce any control over software execution, failing to prevent unsanctioned software and leading to inconsistent configurations.

Practice this question →

185

MCQmedium

Employees sign in once to the corporate portal and then open email, the ticketing system, and an HR application without entering credentials again. The external SaaS providers should trust the company's identity provider rather than creating separate user databases. What architecture is being used?

A.Local authentication on each application with synchronized passwords

B.Federation with single sign-on using the corporate identity provider

C.Network access control using 802.1X authentication

D.Role-based access control on the file server

AnswerB

Federation allows one organization to trust authentication performed by another identity provider. When combined with single sign-on, the user signs in once and then accesses multiple applications without repeated logins. This is exactly what the scenario describes, especially across separate SaaS services.

Why this answer

This scenario describes federation with single sign-on (SSO), where the corporate identity provider (IdP) authenticates the user once and issues a security token (e.g., SAML assertion or OIDC token) that external SaaS providers trust. This eliminates the need for separate user databases in each application and allows seamless access across multiple services without re-entering credentials.

Exam trap

The trap here is that candidates confuse 'single sign-on' with 'synchronized passwords' (Option A) or think that any centralized authentication mechanism (like 802.1X) can replace federated identity for external SaaS trust.

How to eliminate wrong answers

Option A is wrong because local authentication with synchronized passwords still requires each application to maintain its own user database and credential verification, which does not achieve the 'trust the company's identity provider' requirement and introduces password synchronization complexity. Option C is wrong because 802.1X network access control is a port-based authentication mechanism for network access (e.g., wired or Wi-Fi), not for web application SSO or federated identity across SaaS providers. Option D is wrong because role-based access control (RBAC) on the file server governs authorization (what a user can do) after authentication, not the authentication architecture or federated trust between an IdP and external applications.

Practice this question →

186

MCQmedium

A security operations center (SOC) analyst is overwhelmed by the volume of alerts. The management wants to implement a solution that can automatically respond to common threats, such as blocking an IP address or isolating a compromised endpoint, without requiring human intervention. Which of the following technologies best meets this requirement?

A.Security Information and Event Management (SIEM)

B.Security Orchestration, Automation, and Response (SOAR)

C.Endpoint Detection and Response (EDR)

D.Cloud Access Security Broker (CASB)

AnswerB

SOAR platforms are purpose-built to aggregate alerts from multiple sources, execute predefined playbooks, and automatically trigger response actions such as containing a host, blocking an IoC, or opening a ticket. By orchestrating workflows across disparate security tools (e.g., SIEM, EDR, firewalls), SOAR directly reduces the manual triage and repetitive tasks that overwhelm analysts. This capability to automate complex, multi-step incident response without human intervention makes it the exact fit for the scenario.

Why this answer

SOAR is the correct choice because it is specifically designed to automate response actions to common security incidents, such as blocking an IP address via firewall APIs or isolating an endpoint through EDR integration, without requiring human intervention. This directly addresses the SOC analyst's alert fatigue by enabling playbook-driven, automated remediation.

Exam trap

The trap here is that candidates confuse SIEM's alerting capability with automated response, forgetting that SIEMs require a separate SOAR or custom scripting to perform actions, while SOAR is the dedicated solution for orchestrated, automated remediation.

Why the other options are wrong

SIEM aggregates and correlates logs for analysis but lacks native automated response capabilities; it requires human intervention or integration with other tools to block IPs or isolate endpoints.

EDR focuses on detecting and investigating threats on endpoints, but it does not inherently provide automated response orchestration across multiple security tools to block IPs or isolate endpoints without human intervention.

CASB is designed to enforce security policies for cloud services, not to automate response actions like blocking IPs or isolating endpoints across the enterprise.

Practice this question →

187

MCQmedium

Based on the exhibit, which control should be enabled so corporate data stays separated from personal data on company-owned tablets?

A.Perform a full-device wipe any time a tablet is lost or reassigned.

B.Deploy mobile threat defense scanning on every tablet.

C.Enable a work profile or container with selective wipe for corporate data.

D.Disable Bluetooth and the camera on all tablets to stop data leakage.

AnswerC

Enabling a work profile (e.g., Android Work Profile or iOS managed container) creates a dedicated, encrypted boundary that separates corporate apps and data from personal content on the same device. Policies can enforce selective wipe of only that container when a device is lost, reassigned, or non-compliant, preserving the user's personal data. This also allows IT to manage corporate email, VPN, and app restrictions within the profile without granting full control of the personal side—directly addressing the need for workflow separation.

Why this answer

A work profile or container (e.g., Android Work Profile or iOS Managed Open In) creates a separate, encrypted partition for corporate data on the device. This allows IT to perform a selective wipe of only the corporate data without affecting the user's personal apps, photos, or settings, ensuring data separation while preserving user privacy.

Exam trap

The trap here is that candidates confuse security controls like full-device wipe or threat scanning with data separation mechanisms, failing to recognize that only containerization or work profiles provide the granular isolation needed to keep corporate and personal data separate on the same device.

How to eliminate wrong answers

Option A is wrong because performing a full-device wipe on loss or reassignment destroys both corporate and personal data, violating the requirement to keep corporate data separated from personal data; it does not enable ongoing separation. Option B is wrong because mobile threat defense scanning detects malware or suspicious activity but does not isolate corporate data into a separate container; it provides security monitoring, not data separation. Option D is wrong because disabling Bluetooth and the camera reduces data leakage vectors but does not create any logical separation between corporate and personal data; it is a restrictive control that does not address the core requirement of maintaining separate data stores.

Practice this question →

188

MCQmedium

Based on the exhibit, which hardening change best prevents a laptop from booting unapproved tools from external media? Exhibit: UEFI Setup - Secure Boot: Disabled - Boot order: USB, External NIC, Internal SSD - Firmware admin password: Not configured - BitLocker status: Enabled Incident note: A technician confirmed the laptop was started from a USB recovery stick that bypassed the normal corporate login workflow.

A.Enable Secure Boot and change the firmware boot order so only the internal SSD is allowed first.

B.Extend the Windows login timeout so users have more time to notice suspicious activity.

C.Turn off BitLocker so recovery tools can boot without errors.

D.Install a host firewall rule to block USB storage devices from the network.

AnswerA

This is the best control because Secure Boot validates that the bootloader is trusted, and restricting the boot order reduces the chance of booting from unapproved removable media. Together, these changes stop many pre-boot attacks and unauthorized recovery tools before the operating system starts. BitLocker helps protect data at rest, but it does not by itself prevent booting alternate media.

Why this answer

Enabling Secure Boot ensures that only signed, trusted firmware and bootloaders can execute, preventing unauthorized tools like USB recovery sticks from loading. Changing the boot order to prioritize the internal SSD over USB media stops the system from even attempting to boot from external devices, directly addressing the incident where the laptop bypassed corporate login via a USB stick.

Exam trap

CompTIA often tests the misconception that host firewall rules can control local device access, but firewalls operate at the network layer and cannot block USB storage devices, which are managed by hardware or OS-level policies.

How to eliminate wrong answers

Option B is wrong because extending the Windows login timeout does not prevent booting from external media; it only affects the login screen after the OS has already loaded, leaving the boot process vulnerable. Option C is wrong because turning off BitLocker would actually make it easier for unauthorized tools to boot and access data, as BitLocker protects against offline attacks and does not cause boot errors for legitimate recovery tools when properly configured. Option D is wrong because a host firewall rule blocks network traffic, not local USB storage devices; USB storage is controlled by hardware policies or Group Policy, not firewall rules.

Practice this question →

189

MCQmedium

A manufacturer wants to give partner-company users access to a procurement portal. The partner wants to authenticate its own users, and the manufacturer does not want to create separate local passwords for them. What is the best solution?

A.Create shared portal accounts and distribute credentials to the partner's staff.

B.Federate access with the partner's identity provider and map claims or attributes to portal roles.

C.Issue one VPN account for the partner organization and let them share it internally.

D.Require each partner user to create a password directly in the procurement portal.

AnswerB

Federation lets the partner authenticate its own users while the manufacturer trusts identity assertions from the partner identity provider. Claims or attributes can then be mapped to portal roles so access stays controlled without local password management. This is a strong fit for business-to-business access because it preserves administrative separation while still supporting centralized authorization decisions in the portal.

Why this answer

Federation with the partner's identity provider (IdP) using standards like SAML 2.0 or OIDC allows the partner to authenticate their own users while the manufacturer's portal trusts those assertions. Claims or attributes from the IdP (e.g., group membership) are mapped to portal roles, eliminating the need for local passwords and enabling single sign-on (SSO). This is the best solution because it maintains security boundaries and offloads authentication management to the partner.

Exam trap

The trap here is that candidates confuse federation with simple shared accounts or VPN-based access, failing to recognize that federation is the only option that delegates authentication to the partner while preserving individual accountability and eliminating local password management.

How to eliminate wrong answers

Option A is wrong because shared portal accounts violate the principle of least privilege and non-repudiation—multiple users sharing one set of credentials makes auditing impossible and increases the risk of credential leakage. Option C is wrong because a single VPN account shared internally provides no individual accountability, bypasses proper access controls, and does not solve the authentication delegation requirement; it also introduces a VPN dependency that is unnecessary for a web-based procurement portal.

Practice this question →

190

MCQmedium

Based on the exhibit, which access design change best reduces fraud risk without stopping the payroll process? Exhibit: Payroll application roles: - HR-Editor: can update employee records - Payroll-Approver: can release payment batches - Audit-Reader: can view reports only Current assignment: User Lisa has both HR-Editor and Payroll-Approver because she "handles payroll end to end." Management wants to reduce the chance of one person creating and approving a fraudulent payment.

A.Keep both roles assigned but require a manager to review the batch after payment completes.

B.Split duties so record updates and payment approval require separate roles or separate accounts.

C.Remove the audit role and let payroll staff self-review their own work to save time.

D.Use a single shared payroll account so the workflow never pauses for approvals.

AnswerB

This is the best design because it enforces separation of duties, which directly reduces fraud risk. The same person should not be able to create a payment and approve it without independent review. Separate roles or accounts preserve workflow continuity while making collusion or abuse harder, and they provide a cleaner audit trail for accountability.

Why this answer

It enforces separation of duties (SoD) by ensuring that no single user can both create and approve a payment. Splitting the HR-Editor and Payroll-Approver roles into separate accounts or requiring separate users for record updates and payment approval directly mitigates the fraud risk of a single insider creating a fake employee record and then approving a fraudulent payment batch. This aligns with the principle of least privilege and the NIST SP 800-53 AC-5 control for separation of duties, without halting the payroll workflow.

Exam trap

The trap here is that candidates may choose a detective control (like post-payment review) thinking it reduces risk, but the question specifically asks for a change that 'best reduces fraud risk' without stopping the process, and only a preventive control like separation of duties directly addresses the root cause of the conflict of interest.

How to eliminate wrong answers

Option A is wrong because requiring a manager to review the batch after payment completes is a detective control, not a preventive one; fraud could already occur before the review, and the review may be missed or bypassed. Option C is wrong because removing the audit role and letting payroll staff self-review eliminates independent oversight, increasing fraud risk rather than reducing it. Option D is wrong because using a single shared payroll account removes all individual accountability and audit trails, making it impossible to attribute actions to a specific user and actually increasing fraud risk.

Practice this question →

191

MCQmedium

A security architect is designing a solution to process highly sensitive financial transactions in a shared cloud environment. The architect needs to ensure that the processor and memory used to handle transaction data are isolated from the host operating system and other virtual machines, even if the hypervisor is compromised. Which technology is specifically designed to provide this level of isolation for code and data during runtime?

A.Trusted Platform Module (TPM)

B.Hardware Security Module (HSM)

C.Secure enclave (e.g., Intel SGX)

D.UEFI Secure Boot

AnswerC

A secure enclave, such as Intel Software Guard Extensions (SGX), creates hardware-enforced encrypted regions of memory that protect code and data from access by the host OS, hypervisor, or other processes, even if those lower layers are compromised.

Why this answer

Secure enclave technology, such as Intel SGX, provides hardware-enforced isolation by creating trusted execution environments (TEEs) within the CPU. Code and data inside an enclave are encrypted in memory and decrypted only within the processor, ensuring that even a compromised hypervisor or host OS cannot access the transaction data during runtime. This meets the requirement for processor and memory isolation in a shared cloud environment.

Exam trap

The trap here is that candidates often confuse a TPM or HSM with runtime memory isolation, but those technologies focus on storage and cryptographic operations, not on protecting code and data during active execution in a compromised hypervisor environment.

Why the other options are wrong

TPM provides hardware-based key storage and attestation but does not isolate runtime code and memory from the host OS or hypervisor. It cannot protect data during processing in a shared cloud environment.

An HSM provides hardware-based protection for cryptographic keys and operations, but it does not isolate the processor and memory used to run code and data during runtime from the host OS or hypervisor. It is a peripheral device, not a runtime execution environment.

UEFI Secure Boot ensures that only signed firmware and bootloaders execute during system startup, but it does not provide runtime isolation for code and data in memory or CPU. It cannot protect against a compromised hypervisor or isolate transaction processing from the host OS.

Practice this question →