Security Architecture

SY0-701 · 54 questions

• A city migrates staff email to a SaaS provider. Under the cloud shared responsibility model, which split is most accurate?
• A county keeps on-premises Active Directory while rolling out cloud apps for permitting. Which hybrid architecture consideration should security prioritize?
• Public works wants a third-party SaaS product for online permitting. Which architecture implication should the security architect emphasize first?
• The city's cloud team uses infrastructure-as-code templates to deploy identical hardened network baselines for each department. Which security implication is most accurate?
• A library chatbot will run as serverless functions. Which security implication should the architect highlight?
• The 311 application is redesigned as microservices. Which security implication is most important for the new architecture?
• Election tabulation gear must stay isolated from the county office network. How do an air-gapped lab and a logically segmented VLAN differ?
• The transit authority evaluates software-defined networking for its core. Which architecture implication of SDN is most accurate?
• City leadership debates a centralized SOC with shared tooling versus letting each department run its own security stack. Which tradeoff is most accurate?
• A legacy permitting module will be packaged in containers. Which security implication should the architect call out?
• The municipal virtualization cluster hosts many VMs on each physical host to save cost. Which security consideration is most relevant?
• Smart streetlight sensors are being added across downtown. Which IoT architecture implication should security emphasize?
• Wastewater SCADA prioritizes plant uptime and safety, and some controllers cannot be patched on desktop-like schedules. Which implication best reflects ICS/SCADA security architecture?
• Traffic-signal controllers run a real-time operating system with limited security tooling. Which statement best captures the architecture implication?
• Architects are placing controls for a citizen portal and for privileged admin access to backend servers. Which placement best matches secure infrastructure practice?
• The city needs a public web presence and a protected finance network. Which zoning approach best reduces attack surface?
• Facilities debates door-controller failure behavior versus traffic-signal safety behavior during outages. Which guidance is most appropriate?
• Network engineers must choose between an inline IPS and a tap/monitor IDS for a county uplink. Which distinction is correct?
• City hall wants controlled outbound web access with content filtering for staff browsers. Which appliance role fits best?
• The 311 portal needs traffic spread across several web servers and may terminate TLS at the edge. Which appliance primarily provides that role?
• Council chambers switches must stop unknown devices and rogue access points from getting LAN access. Which approach best fits?
• Attackers are targeting the citizen portal with HTTP application attacks such as injection and abusive web requests. Which control is the best fit for that threat layer?
• Remote municipal staff need protected access to internal systems over the Internet. Which approach best matches secure remote access architecture?
• A county library system wants branch sites to share a centrally managed WAN policy for encrypted paths and traffic steering without building a full MPLS mesh. Which technology best matches that goal?
• A city moves to a cloud-first model where remote staff access SaaS and municipal apps from many locations. Leadership wants networking and security services delivered together near the user. Which concept describes that approach?
• A municipal data center needs visibility into east-west traffic between application tiers so an IDS can detect lateral movement. Where should sensors be placed to support that goal?
• A remote pump station has very limited bandwidth back to the operations center. How should that constraint shape the monitoring architecture?
• Remote vendors dial into city systems using only longer passwords. Which control selection most effectively reduces remote-access risk?
• A small township wants one appliance that consolidates firewall, intrusion prevention, and related security functions instead of managing many separate boxes. Which solution fits that need?
• Administrators currently expose Remote Desktop Protocol directly to the Internet. Which change best reduces that attack surface?
• A records officer must label data correctly: 911 call recordings versus published park event schedules. Which classification approach is appropriate?
• An unpublished GIS map detailing water-valve vulnerabilities is kept internal because disclosure would aid saboteurs. Which data type best describes that map for protection decisions?
• Backup disks sit encrypted in a vault, a nightly job copies them over TLS to the DR site, and analysts query live datasets in memory. Which pairing correctly matches those data states?
• A public-health department must keep resident health records stored in-region due to legal placement rules. Which requirement is being applied?
• Developers must protect SSN fields in a database, store passwords safely, and show only partial payment card numbers on clerk screens. Which combination of methods is appropriate?
• Regulated employee data lives on an HR file share. How should access be constrained?
• Security staff handle both a human-readable PDF employee roster and binary SCADA sensor dumps. Why does readability matter for protection approaches?
• SCADA setpoint files that keep water treatment stable are far more critical than marketing PDFs on the public website. How should protections differ?
• A city parking system must store payment references without retaining raw primary account numbers in the municipal database. Which method best meets that goal?
• Police records subject to CJIS-adjacent handling rules sit beside ordinary office memos. What should drive control strength for those police records?
• A vendor demo needs production-like municipal data in a test environment. Which practice appropriately reduces exposure?
• Backup tapes leave the building nightly, and USB ports on clerk PCs are a known exfiltration path. Which layered approach addresses both risks?
• 911 dispatch needs near-immediate failover capacity, while a rarely used archive system can tolerate long rebuild time. Which site strategy fits?
• Municipal IT currently runs both primary and backup data centers in the same floodplain building complex. What resilience change addresses regional disaster risk?
• The utility customer portal must stay available if one web node fails. How do load balancing and clustering differ as high-availability approaches?
• A single cloud vendor outage halted several municipal services last year. Which resilience strategy reduces that common-mode failure risk?
• Before ransomware hits, leadership wants staff to walk through decision-making without taking production systems offline. Which testing type fits?
• The tax database requires reliable recovery after corruption or ransomware. Which backup design elements are most appropriate?
• Before a major upgrade to the county permitting database, the team needs a quick restore point on the same host, while the disaster-recovery site must stay nearly current for day-to-day failover. Which pairing best matches those needs?
• City hall loses utility power for two minutes, then later faces a multi-hour outage during a storm. Which power-resilience pairing correctly describes UPS and generator roles?
• Before hurricane season, the municipal emergency-ops team must scale permit and shelter systems. What should capacity planning cover?
• A flood closes the primary city offices, but residents still need building permits issued. Which plan focus best keeps that essential function running from an alternate facility?
• During a scheduled failover test for the library catalog, cutover is delayed because DNS TTLs keep clients pointed at the old site. What does this outcome mainly illustrate?
• Transit dispatch can lose at most a few minutes of data, while a low-priority archive can tolerate overnight loss. How should recovery objectives influence backup versus replication choices?