SY0-601 Architecture & Design 2

Question 1

A company wants to ensure that a compromised application server cannot be used to pivot to the database server. Which network segmentation control BEST achieves this?

Accepted Answer

Microsegmentation with host-based firewall policies

Answer

Microsegmentation enforces granular east-west traffic policies between individual workloads, preventing lateral movement even within the same network zone.

Question 2

Which secure network architecture concept places resources that must be publicly accessible in an isolated zone separate from the internal network?

Accepted Answer

DMZ (Demilitarized Zone)

Answer

A DMZ is a buffer zone between the internet and the internal network where public-facing servers are isolated so that a compromise does not directly expose internal systems.

Question 3

An organization deploys an application that processes payment data. The security architect recommends a deception technology to detect attackers who have already breached the network. What is this technology called?

Accepted Answer

Honeypot

Answer

A honeypot is a decoy system designed to lure and detect attackers who have already gained internal network access.

Question 4

A cloud architect needs to encrypt data so that it can still be searched and queried without full decryption. Which encryption concept supports this requirement?

Accepted Answer

Homomorphic encryption

Answer

Homomorphic encryption allows computations to be performed on ciphertext, producing encrypted results that match operations on the plaintext.

Question 5

During a design review, a security engineer recommends that all internal services authenticate each request independently rather than relying on network location. This is a core principle of which model?

Accepted Answer

Zero trust architecture

Answer

Zero trust architecture operates on the principle of 'never trust, always verify,' requiring authentication and authorization for every request regardless of network origin.

(SY0-601) CompTIA Security+ IT Certification Practice Test

(SY0-601) CompTIA Security+ IT Certification Practice Test

SY0-601 Architecture & Design 2