SY0-601 Architecture & Design 5 — Questions and Answers
Question 1: A security architect recommends using an SDK that automatically enforces HTTPS, parameterized queries, and input sanitization for all new applications. This approach best exemplifies which principle?
- Security by obscurity
- Secure by default (Correct answer)
- Fail open design
- Defense in depth
Correct answer: Secure by default
Secure by default means that security controls are enabled out of the box, so developers must actively choose to weaken them rather than actively choose to enable them.
Question 2: An organization requires that no single administrator can both create a privileged account AND approve access for that account. Which security principle does this implement?
- Least privilege
- Separation of duties (Correct answer)
- Need to know
- Job rotation
Correct answer: Separation of duties
Separation of duties divides critical tasks between multiple individuals so that no single person can commit fraud or error without collusion.
Question 3: An application is designed so that if the authentication service becomes unavailable, all access to the system is denied rather than allowed. Which design concept does this reflect?
- Fail open
- Fail secure (fail closed) (Correct answer)
- Defense in depth
- High availability
Correct answer: Fail secure (fail closed)
Fail secure ensures that a system defaults to a secure, restricted state when a component fails, preventing unauthorized access during outages.
Question 4: A healthcare organization must store patient records for 7 years per HIPAA requirements. Which architectural component should be designed to enforce this retention policy automatically?
- DLP gateway
- Data lifecycle management / object lock (Correct answer)
- Backup rotation schedule
- SIEM log retention policy
Correct answer: Data lifecycle management / object lock
Data lifecycle management with object lock (WORM) enforces retention policies automatically, preventing records from being deleted before the mandated retention period expires.
Question 5: Which network architecture concept uses software to dynamically provision and configure virtual network functions (firewalls, load balancers) without dedicated physical hardware?
- Software-Defined Networking (SDN) (Correct answer)
- Spanning Tree Protocol
- Link aggregation (LACP)
- MPLS traffic engineering
Correct answer: Software-Defined Networking (SDN)
SDN decouples the control plane from the data plane, allowing network functions to be provisioned and configured programmatically through software.
Question 6: A company adopts a BYOD policy and wants to ensure that corporate data on personal devices is wiped remotely if a device is lost, without affecting personal data. Which technology supports this?
- Full-device MDM enrollment with remote wipe
- Containerization / MAM with selective wipe (Correct answer)
- Host-based DLP agent installation
- VPN split tunneling
Correct answer: Containerization / MAM with selective wipe
Mobile Application Management (MAM) with containerization separates corporate data into a managed container that can be selectively wiped without touching personal data.
Question 7: A security engineer is evaluating a third-party vendor's API integration. The vendor authenticates using a long-lived shared secret embedded in each request header. Which improvement should the engineer recommend?
- Switch to OAuth 2.0 with short-lived access tokens (Correct answer)
- Encode the shared secret in Base64 before transmission
- Use HTTP Basic Auth over HTTPS instead
- Store the shared secret in a cookie with the HttpOnly flag
Correct answer: Switch to OAuth 2.0 with short-lived access tokens
OAuth 2.0 with short-lived access tokens limits the window of exposure if a token is compromised and eliminates the need to share long-lived static secrets.
SY0-601 Architecture & Design 5
A security architect recommends using an SDK that automatically enforces HTTPS, parameterized queries, and input sanitization for all new applications.
This approach best exemplifies which principle?