Security+ SY0-801 Practice Questions: Security Architecture

Correct answer: D. Data sovereignty

D is correct because data is subject to the laws of the country where it is stored, so the regions must keep the records under EU jurisdiction. A divides security duties between the provider and the customer, but does not decide where the data may legally reside. B sets how sensitive the records are and how they must be handled, but not which legal jurisdiction they must stay in. C concerns how well the design grows with demand, which does not address the regulator's legal requirement.

Correct answer: D. Community cloud

D is correct because the infrastructure is shared by several organizations with common concerns, such as the same compliance rules. A is open to any customer who signs up, not limited to a group of organizations with shared requirements. B is dedicated to a single organization, while this environment is shared by several credit unions. C combines two or more deployment models, such as private and public, rather than describing a shared group environment.

Correct answer: C. Serverless

C is correct because the provider runs and scales the underlying servers, and the customer supplies only event-driven code. A give the customer a full guest operating system that the customer must patch and manage. B runs on hardware the organization owns and manages in its own facility. D splits an application into small independent services, but does not by itself remove server management from the customer.

Correct answer: C. Air-gapped network

C is correct because the network is physically isolated, so data can move in or out only through deliberate manual transfer. A separates traffic on shared hardware with configuration, so the network would still be connected to others. B is cloud infrastructure dedicated to one organization, which is still reachable over a network. D is a buffer zone that is connected to both the internet and the internal network.

Correct answer: D. Logical segmentation

D is correct because the traffic is separated through configuration while the groups continue to share the same physical hardware. A is an application design that splits software into independent services, not a way to separate network traffic. B uses separate switches and cabling for each group, which this design does not do. C has no connection to any other network, while these groups share switches.

Correct answer: B. On-premises infrastructure

B is correct because the organization owns, houses, and manages the hardware itself, so it keeps full physical control. A hands all server management to a cloud provider, which is the opposite of the requirement. C is shared by several organizations and is commonly operated by a third party. D runs workloads on hardware the provider owns and operates in its own data centers.

Correct answer: C. Hybrid cloud

C is correct because it combines on-premises or private infrastructure with public cloud services that work together. A is shared by organizations with common requirements, not a mix of private and public resources. B uses services from several cloud providers, while this design uses one provider plus its own data center. D keeps all resources dedicated to the retailer, so the storefront would not run on a public provider.

Correct answer: B. More service-to-service traffic to authenticate

B is correct because each service exposes its own interface, so every internal call between services must be authenticated and protected. A is not a result of splitting an application into services, since the company still owns its code. C is incorrect, because more traffic moves across the network between services and still needs protection. D describes a monolith, while independent services can fail without stopping the others.

Correct answer: A. Availability

A is correct because continuous operation of the process outweighs frequent patching, so changes wait for planned downtime. B concerns how software is licensed and reviewed, not why the controllers must keep running. C decides how sensitive information is labeled and handled, not when controllers can be restarted. D concerns growing capacity to meet demand, which is not why the plant delays reboots.

Correct answer: C. Physical segmentation

C is correct because each environment uses separate network hardware, so no device is shared between them. A encapsulates traffic inside another protocol, but the traffic still crosses shared hardware. B combines private and public cloud resources and says nothing about separating network hardware. D separates traffic with configuration on shared devices, which the auditor has ruled out.