SY0-601 Architecture & Design 2 — Questions and Answers
Question 1: A company wants to ensure that a compromised application server cannot be used to pivot to the database server. Which network segmentation control BEST achieves this?
- VLAN tagging on all switches
- Microsegmentation with host-based firewall policies (Correct answer)
- Placing both servers behind a single perimeter firewall
- Enabling port security on the switch connecting the servers
Correct answer: Microsegmentation with host-based firewall policies
Microsegmentation enforces granular east-west traffic policies between individual workloads, preventing lateral movement even within the same network zone.
Question 2: Which secure network architecture concept places resources that must be publicly accessible in an isolated zone separate from the internal network?
- Air gap
- DMZ (Demilitarized Zone) (Correct answer)
- Zero trust overlay
- VLAN hopping prevention
Correct answer: DMZ (Demilitarized Zone)
A DMZ is a buffer zone between the internet and the internal network where public-facing servers are isolated so that a compromise does not directly expose internal systems.
Question 3: An organization deploys an application that processes payment data. The security architect recommends a deception technology to detect attackers who have already breached the network. What is this technology called?
- Honeypot (Correct answer)
- IDS sensor
- SIEM correlation rule
- Web application firewall
Correct answer: Honeypot
A honeypot is a decoy system designed to lure and detect attackers who have already gained internal network access.
Question 4: A cloud architect needs to encrypt data so that it can still be searched and queried without full decryption. Which encryption concept supports this requirement?
- Homomorphic encryption (Correct answer)
- Full-disk encryption
- Symmetric key encryption
- Envelope encryption
Correct answer: Homomorphic encryption
Homomorphic encryption allows computations to be performed on ciphertext, producing encrypted results that match operations on the plaintext.
Question 5: During a design review, a security engineer recommends that all internal services authenticate each request independently rather than relying on network location. This is a core principle of which model?
- Defense in depth
- Zero trust architecture (Correct answer)
- Perimeter security model
- Least privilege access
Correct answer: Zero trust architecture
Zero trust architecture operates on the principle of 'never trust, always verify,' requiring authentication and authorization for every request regardless of network origin.
Question 6: A security architect wants to prevent a single vulnerability from compromising an entire system by implementing multiple, independent security controls. Which design principle does this represent?
- Fail secure
- Defense in depth (Correct answer)
- Separation of duties
- Least functionality
Correct answer: Defense in depth
Defense in depth layers multiple security controls so that if one fails, others continue to protect the system.
Question 7: An architect is designing an ICS environment for a power utility. To prevent any digital communication path between the operational network and the internet, which control should be implemented?
- Stateful firewall with ACLs
- Air gap (Correct answer)
- IDS/IPS inline deployment
- Network access control (NAC)
Correct answer: Air gap
An air gap physically isolates the ICS network from all external networks, including the internet, eliminating any digital attack path.
SY0-601 Architecture & Design 2
A company wants to ensure that a compromised application server cannot be used to pivot to the database server.
Which network segmentation control BEST achieves this?