Security Architecture

SY0-801 · 57 questions

• A company migrated its application servers to virtual machines in a public IaaS offering. A vulnerability scan reveals that the guest operating systems are missing months of security patches because the administrators assumed the provider applies them. Under the shared responsibility model, who is responsible for patching these guest operating systems?
• A development team moves several APIs from virtual machines to serverless functions on a public cloud platform. A manager asks which security tasks the team still owns now that there are no servers to administer. Which set of tasks remains the team's responsibility?
• Several regional hospitals with similar regulatory obligations agree to share a cloud environment that is used only by their member organizations and is governed jointly under a common set of security and compliance requirements. Which cloud deployment model does this arrangement describe?
• A retailer keeps its payment-processing systems in its own data center but automatically shifts web front-end workloads to a public cloud provider during seasonal traffic peaks. Which deployment model is this, and what is a key security implication?
• A cloud team deploys 50 environments from a single infrastructure-as-code template. A later review finds that the same storage bucket in every environment allows public read access, all traced to one line in the template. What does this situation BEST illustrate about infrastructure as code?
• A manufacturer's security team learns that the programmable logic controllers on a production line have a published vulnerability. Applying the vendor's firmware update requires stopping the line, and an unplanned stop creates safety hazards. Which approach BEST fits the priorities of this operational technology environment?
• A research lab keeps its classified design network physically disconnected from all other networks, with no wired or wireless links. Malware is nevertheless found on several workstations in that network, and the investigation traces it to a USB drive a contractor used to move test files into the lab. What does this incident BEST demonstrate about air-gapped networks?
• A company splits its monolithic e-commerce application into dozens of microservices that call one another through internal APIs. The architects previously relied on a perimeter firewall in front of the single application. Which security implication should they address FIRST in the new design?
• A retailer must isolate its cardholder data environment from the rest of the network. An assessor warns that with VLANs on shared switches, a single switch misconfiguration could bridge the zones. Management requires isolation that does not depend on the configuration of shared network devices, regardless of cost. Which approach meets this requirement?
• An online service runs entirely in one cloud region, spread across that region's availability zones. The business now requires the service to keep running and recover quickly even if the entire region becomes unavailable. Which architectural change BEST meets this requirement?
• A development team must choose between an open-source cryptography library and a proprietary SDK with similar features. The security team requires the ability to inspect the source code during reviews and has staff available to track and apply updates itself. Which statement accurately reflects a security implication of choosing the open-source library?
• A software company plans to host customer data for European clients in a cloud platform. Its contracts require that this data remain within the European Union because it is subject to the laws of the country where it is stored. Which business consideration is driving this architectural constraint?
• A startup with a small security budget expects its customer traffic to grow roughly tenfold over the next two years and wants to avoid large upfront hardware purchases. Which approach to its security architecture BEST balances cost and scalability?
• A network team is adding an intrusion prevention system to the internet edge. They want it to block attacks in real time but inspect only traffic that the edge firewall has already permitted, so it is not overloaded by traffic the firewall would drop anyway. Where should the IPS be placed?
• An organization hosts public web servers that must be reachable from the internet, but if one is compromised, the attacker must not have direct access to internal workstations and databases. Which design BEST meets this requirement?
• An external scan shows that the web administration interfaces and SSH services on the company's firewalls and core switches are reachable from every user VLAN, and one firewall's admin page is reachable from the internet. Which action MOST effectively reduces this attack surface?
• A company protects its data center with two layers of firewalls, both the same model from the same vendor. An attacker uses a single exploit for that model's firmware to bypass both layers in one step. Which architectural principle would MOST directly have reduced this risk?
• In a zero trust deployment, an employee who signed in at 8:00 a.m. tries at 2:00 p.m. to download a large, highly sensitive dataset from an unfamiliar location. The policy engine evaluates the request and requires the employee to complete MFA again before access is granted. Which zero trust practice does this BEST demonstrate?
• A user with a valid username, password, and MFA approval is denied access to the company's internal applications. The access logs show that the zero trust policy engine rejected the request because the user's laptop is missing critical operating system patches and its endpoint protection agent is not reporting. Which zero trust control caused the denial?
• Contractors need access to a single internal web application. Today they connect through a full-network VPN that lets them reach every internal subnet once connected. The security team wants to apply zero trust principles without placing contractors on the internal network at all. Which approach BEST meets this goal?
• A company is opening a branch office and needs all traffic between the branch network and headquarters to travel over the internet encrypted, without installing client software on each branch workstation. Which solution BEST meets this requirement?
• A company with a mostly remote workforce wants to retire the practice of backhauling user traffic to headquarters. It needs a cloud-delivered service that provides secure web gateway filtering, cloud access security broker controls, and zero trust access to private applications, without replacing its existing WAN routing. Which solution BEST fits?
• A routing loop has taken down the production network, and administrators cannot reach the core switches over SSH because SSH runs over that same network. Which capability would have let them reach the switches' management consoles during this outage?
• A company exchanges payroll files with a partner using plain FTP over the internet. An audit finds that usernames, passwords, and file contents can be captured by anyone on the network path. Which replacement BEST addresses this finding?
• Executives want a messaging platform for board discussions with the requirement that the service provider itself must be unable to read message contents, even if its servers are compromised or it receives a legal demand. Which capability BEST satisfies this requirement?
• A Windows domain uses one service account to run a line-of-business service on 30 servers. Its password has not been changed in five years because updating it on every server manually risks an outage. Which solution BEST resolves this while removing the manual password handling?
• During a quarterly access review, an auditor finds that an employee who moved from accounts payable to purchasing and then to IT support still holds the permissions from all three roles. No permissions were removed at any transfer. Which issue does this BEST describe, and how should it be remediated?
• A review finds that system administrators read email, browse the web, and open documents while signed in with their domain administrator accounts. Which change BEST applies least privilege to reduce the impact if one of these activities leads to a compromise?
• A building's power fails. The electronic lock on an emergency exit door along an evacuation route and the perimeter firewall protecting the data center network are both affected. Which failure mode configuration is MOST appropriate for these two devices?
• A data discovery scan finds customer details in a relational database with defined fields and the same details scattered across email messages, PDF reports, and slide decks on file shares. Which statement BEST describes the difference in protecting these two data types?
• An analytics service decrypts customer records so it can run calculations on them, and the security team is worried that an attacker with access to the host could read the plaintext straight out of RAM while the computation runs. Which data state is exposed, and which protection addresses it most directly?
• A company writes nightly backups to a disk array in its data center and then replicates those backup sets across a leased WAN link to a disaster recovery site. Which pairing of controls correctly protects the backups in each data state?
• A manufacturer's production control recipes are not secret from staff, but if they were lost or unavailable the assembly lines would stop within hours. Which data classification best describes information whose defining concern is that the business cannot operate without it?
• A defense contractor stores government documents marked Secret alongside others marked Top Secret, and a new hire asks how the two markings relate. Which statement correctly describes the relationship between these classification levels?
• Call center agents must confirm a caller's identity using only the last four digits of the payment card, while the billing system must keep storing and charging the full card number. Which data protection method best meets both requirements?
• A payment platform replaces every stored card number with a random surrogate value that has no mathematical relationship to the original, and only a separately protected vault can map a surrogate back to the real number. Which data protection method is this?
• A hospital will give an outside research team a copy of patient records so the team can study diagnoses and treatment outcomes, but the researchers must not be able to identify any individual patient, even with full access to the copy they receive. Which method best meets this requirement?
• An application must confirm that the answer a user types to a security question matches the answer given at enrollment, but the database must never hold the original answers in a form that anyone could recover. Which method should the developers use?
• The vice president of human resources decides that payroll records are confidential and approves who may read them, while the IT storage team configures the backups, encryption and access permissions she approved. Which roles do the vice president and the storage team hold, in that order?
• A retailer collects customer data and decides why and how it is processed. It contracts a cloud CRM vendor to process the data on its behalf, and that vendor engages a separate support firm that also handles the retailer's customer records. How should the support firm be classified?
• A company names an analyst in its marketing division to own the consistency of customer data definitions, data quality rules and accurate metadata for the customer dataset. She does not decide the dataset's classification and does not run the servers. Which data role has the company assigned?
• A healthcare firm wants its patient records app on corporate tablets to refuse to open any record whenever the device's reported location is outside the country, regardless of which network the tablet is using. Which data handling control meets this requirement?
• Sensitive design documents keep leaving the company by email because staff do not realize the files are sensitive, and the data loss prevention system cannot distinguish them from routine files. Which first step best addresses both problems?
• The retention period that company policy sets for closed customer accounts has ended, and legal counsel confirms that no legal hold applies to those records. Which action should follow in the data management life cycle?
• A firm needs its order system running at an alternate location within roughly a day of losing its primary data center. Leadership will not pay for continuous real-time replication, but it will fund standby hardware and network links that are kept ready. Which recovery site fits?
• Every production workload a company runs sits on a single hypervisor product, and a new advisory warns that one escape flaw in that hypervisor could let an attacker compromise all of the workloads at once. Which resilience strategy most directly removes this single point of failure?
• An application has a stateless web tier that any server can serve and a stateful database that must keep one consistent copy of its data and move to a standby node if the primary node fails. Which pairing of resilience techniques best fits the two tiers?
• An online store running on cloud virtual machines is overwhelmed by traffic spikes during flash sales, while between events the extra capacity it keeps running sits idle and costs money. Which resilience approach best addresses both problems?
• A server room suffers frequent power interruptions and brownouts lasting from a few seconds to a few minutes, and each one causes servers to reboot. Long multi-hour outages are rare and are already covered by an on-site generator. Which addition best fixes the reboots?
• Attackers used stolen administrator credentials to encrypt the company's backup repository along with its production servers. Which backup capability would have prevented them from altering or deleting the existing backup copies, even with administrator rights?
• A company's nightly backup jobs have reported success for months, but when an incident forces a restore, the data cannot be recovered because the backup media are corrupt. Which practice would most likely have revealed the problem beforehand?
• A backup team is asked to define which servers, databases and SaaS data must be included in backups, and how long each set of copies must be kept to satisfy legal and business requirements. Which two backup concepts is the team defining?
• A company wants to prove that its disaster recovery systems can actually process real transaction workloads correctly, but production must stay online and serving customers throughout the test. Which type of test best meets both requirements?
• After any failure of its order database, the business states it can tolerate losing no more than 15 minutes of order data. Which recovery metric does this statement define, and what does that metric drive?
• A team is comparing two firewall models. Model X has a mean time between failures of 50,000 hours and a mean time to repair of 8 hours. Model Y has a mean time between failures of 30,000 hours and a mean time to repair of 2 hours. Which statement is correct?
• During a regional flood, a company keeps taking customer orders by phone with paper forms and relocates key staff to a partner office, while the IT team works separately to bring the flooded data center's systems back. Which plan governs keeping those essential business functions running?
• Growth projections show that within a year the security operations center's log volume will exceed its storage, its analysts will be unable to keep up with alert volume, and its network links will saturate. Which practice addresses these needs across people, technology and infrastructure before the shortfall arrives?