SY0-701 Security Architecture Practice Question
Field technicians use company-owned tablets that also run approved personal apps. Security needs corporate email and documents isolated from personal data, selective wipe of only business content if a device is lost, and compliance checks before access is allowed. What should be deployed?
⚠ Common exam trap
It's easy for candidates to confuse full-disk encryption (which only protects data at rest) with the isolation and selective-wipe capabilities of a managed work profile, or they assume a VPN or antivirus alone can enforce data separation and compliance checks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mobile device management with a work profile or container and conditional access.
Mobile device management (MDM) with a work profile or container (e.g., Android Work Profile or iOS Managed Open In) provides the required isolation between corporate and personal data. Conditional access enforces compliance checks (e.g., device health attestation, OS patch level) before granting access to corporate resources. This combination also enables selective wipe of only the work container without affecting personal apps or data, meeting the lost-device requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Full-disk encryption on the tablets with no additional device management.
Why it's wrong here
Full-disk encryption (FDE) protects data at rest, making it unreadable if the tablet is lost or stolen, but it provides no ongoing device management. FDE alone cannot enforce security policies, perform remote selective wipes, or isolate corporate applications from personal apps on a shared device. Because the encryption is transparent after the device is unlocked, any malicious or vulnerable app running in the same user space can still access decrypted business data. It also lacks conditional access checks to ensure the device is compliant before reaching corporate resources.
- ✓
Mobile device management with a work profile or container and conditional access.
Why this is correct
Mobile device management (MDM) with a work profile or container creates a hard logical separation between corporate data and personal apps on the same tablet. Conditional access policies can then require device compliance (such as patch level, root/jailbreak status, and lock screen strength) before granting access to corporate email or internal applications. This architecture allows IT to selectively wipe only the managed corporate container without touching personal data, and to enforce app-level restrictions. Together, containerization and conditional access directly address the need to manage company-owned tablets that also serve personal use, unlike encryption, VPN, or antivirus alone.
- ✗
A mobile VPN client with split tunneling enabled for user convenience.
Why it's wrong here
A mobile VPN client with split tunneling encrypts only traffic destined for the corporate network while personal internet traffic bypasses the tunnel for convenience. This approach protects data in transit but does nothing to separate or containerize business applications and data on the device itself. Split tunneling can actually broaden the attack surface because personal traffic is uninspected and may deliver malware that then co-resides with corporate data. It also offers no capability for conditional access enforcement or selective remote wipe, so it is insufficient for managing a dual-use tablet.
- ✗
An antivirus app with a blacklist of approved and unapproved mobile apps.
Why it's wrong here
An antivirus app with an app blacklist is a reactive, endpoint-focused control that cannot manage the full mobile device lifecycle. It may block known malicious or unapproved applications, but it provides no containerization, so corporate and personal data remain commingled on the device. Blacklists are also easily bypassed via sideloading or zero-day threats, and the app cannot enforce broader compliance policies like OS patch levels, passcode complexity, or remote selective wipe. Furthermore, it lacks the centralized visibility and conditional access integration needed to make admission decisions to corporate resources.
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Bring Your Own Device
A policy allowing employees to use their personal laptops, smartphones, or tablets for work tasks instead of using company-issued equipment.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Field staff use company-owned tablets that also run approved personal apps. Security needs business data isolated from personal data, the ability to wipe only corporate content, and enforcement of screen lock and encryption. Which two controls best fit? Select two.
medium- ✓ A.Enroll the tablets in MDM and enforce encryption and a screen-lock PIN.
- ✓ B.Use a managed work profile or container to separate corporate apps and data.
- C.Allow rooted devices if the antivirus app is current.
- D.Place all apps in one shared profile and use a single passcode for every user.
- E.Disable remote wipe so personal photos are never affected.
Why A: Mobile Device Management (MDM) enforces security policies like encryption and screen-lock PIN across the device, meeting the requirements for data protection. Option B is correct because a managed work profile or container (e.g., Android Work Profile or iOS Managed Open In) isolates corporate apps and data from personal apps, allowing selective wipe of corporate content without affecting personal data.
Variation 2. Field staff use company-owned tablets that also run approved personal apps. Security wants corporate email and documents separated from personal data, with the ability to wipe only the work data if a device is lost. What is the best control?
easy- ✓ A.Use a work profile or container managed by a mobile device management platform.
- B.Disable all personal apps by removing internet access from the tablet.
- C.Install only a screen lock and require a longer PIN for the tablet.
- D.Use a USB cable lock so the tablet cannot be physically moved.
Why A: A work profile or container managed by a mobile device management (MDM) platform creates a separate, encrypted partition on the device for corporate data. This allows the organization to enforce policies and perform a selective wipe of only the work container without affecting personal apps or data, meeting the requirement for separation and targeted remote wipe.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.