SY0-601 Architecture & Design 4 â Questions and Answers
Question 1: A security team implements a system that automatically revokes and rotates credentials when anomalous API usage is detected. This is an example of which security architecture principle?
- Fail open
- Automated response and orchestration (Correct answer)
- Manual incident response
- Role-based access control
Correct answer: Automated response and orchestration
Automated response and orchestration (SOAR) reduces dwell time by triggering remediation actions such as credential rotation without human intervention.
Question 2: Which data security technique replaces sensitive data elements with non-sensitive placeholders that retain the format but have no exploitable value outside the specific system?
- Encryption
- Tokenization (Correct answer)
- Hashing
- Data masking
Correct answer: Tokenization
Tokenization substitutes sensitive data (e.g., a credit card number) with a token that is meaningless outside the tokenization system, reducing PCI DSS scope.
Question 3: An enterprise CISO wants to ensure that cloud-hosted workloads adhere to security baselines continuously, not just at deployment time. Which tool category addresses this requirement?
- Cloud Access Security Broker (CASB)
- Cloud Security Posture Management (CSPM) (Correct answer)
- Web Application Firewall (WAF)
- Security Information and Event Management (SIEM)
Correct answer: Cloud Security Posture Management (CSPM)
CSPM tools continuously monitor cloud environments for configuration drift and compliance violations against defined security baselines.
Question 4: A company needs employees to prove their identity using something they know, something they have, and something they are before accessing sensitive systems. This is an example of:
- Single sign-on (SSO)
- Multi-factor authentication (MFA) (Correct answer)
- Federated identity
- Role-based access control (RBAC)
Correct answer: Multi-factor authentication (MFA)
MFA combines multiple authentication factorsâknowledge, possession, and inherenceâto significantly reduce the risk of unauthorized access.
Question 5: A network architect is designing a campus with multiple buildings. To prevent a broadcast storm in one building from affecting others, which design technique should be used?
- Spanning tree protocol (STP) tuning
- VLAN segmentation per building (Correct answer)
- Static routing between buildings
- MAC address filtering
Correct answer: VLAN segmentation per building
VLANs logically isolate broadcast domains so that a storm or failure in one VLAN does not propagate to VLANs in other buildings.
Question 6: During a threat model, the team identifies that an attacker could intercept communications between internal microservices. Which control directly mitigates this east-west traffic threat?
- Perimeter TLS termination at the load balancer
- Mutual TLS (mTLS) between all microservices (Correct answer)
- HTTPS only for external-facing APIs
- Network-level IDS signatures
Correct answer: Mutual TLS (mTLS) between all microservices
Mutual TLS (mTLS) ensures that both the client and server microservices authenticate each other and encrypt the channel, protecting east-west traffic from interception or spoofing.
Question 7: A cloud provider offers a shared responsibility model. For a SaaS application, which security domain is the customer primarily responsible for?
- Physical security of data centers
- Hypervisor patching
- User access management and data governance (Correct answer)
- Network infrastructure redundancy
Correct answer: User access management and data governance
In the SaaS model, the provider manages infrastructure through the application layer; the customer is responsible for managing user identities, access controls, and the data they store.
SY0-601 Architecture & Design 4
A security team implements a system that automatically revokes and rotates credentials when anomalous API usage is detected.
This is an example of which security architecture principle?