Multicloud is the new normal, and this month AWS pushed that reality further by extending Security Hub to Microsoft Azure with fresh AI workload protection. That announcement is exactly why cloud security architecture is again the hottest topic on the SY0-701 blueprint. For instance, if you are preparing for CompTIA Security+, Domain 3 will test whether you can pick the right control for the right deployment model under real business constraints.
This post kicks off our SY0-701 practice series with Questions 1 through 10. Each scenario reflects the type of “best fit” comparison you will see on exam day. Specifically, one requirement — least privilege, blast radius, latency, cost, or visibility — should eliminate the plausible-but-wrong choices. Expect a mix of shared responsibility, zero trust, IAM, segmentation, containers, serverless, SASE, and multicloud posture management.
Difficulty ramps from foundational to scenario-heavy so you can warm up and then stretch. In addition, we tag each explanation with why the wrong options are wrong, because that pattern of elimination is exactly what CompTIA tests. Grab a notebook, work each question before you reveal the answer, and note anything you had to guess. Those gaps are your study plan.
One quick note on the trending angle. AWS Security Hub now ingests findings from Azure virtual machines, container images, and function apps, and it prioritizes them alongside AWS findings in one queue. Consequently, exam scenarios about multicloud posture are no longer edge cases. In fact, they are becoming the default cloud security architecture pattern that SY0-701 will keep testing. Several questions below reflect that shift, so treat them as a preview of where the industry is heading, not a curiosity.
Question 1: Shared Responsibility in Cloud Security Architecture
Contoso is moving its e-commerce platform from a private data center to an IaaS provider. Leadership wants clarity on which security tasks the cloud provider owns versus which the Contoso team must own. Which control is Contoso still responsible for under a standard IaaS model?
A) Physical security of the data center campus
B) Patching the hypervisor that runs guest VMs
C) Hardening the guest operating system and applications
D) Replacing failed disk drives in the storage array
👁 Reveal Answer
Correct Answer: C
Explanation: Under the shared responsibility model for IaaS, the provider handles security “of” the cloud (facilities, hardware, hypervisor, and physical media), while the customer handles security “in” the cloud. Therefore, patching the guest OS, hardening applications, managing IAM, and protecting data remain Contoso’s duty. Options A, B, and D all describe provider duties in an IaaS engagement. This distinction matters because misreading the boundary is one of the top root causes of cloud breaches. For example, teams often assume the CSP is patching workloads it does not own.
Question 2: Zero Trust for a Fully Remote Workforce
Your organization has adopted a fully remote workforce and wants to retire its aging VPN concentrator. The CISO asks for a design that assumes no implicit trust based on network location. Which principle should sit at the center of the new access model?
A) Grant broad network access after successful VPN authentication
B) Verify identity and device posture on every request, then grant least-privilege access
C) Whitelist all corporate laptops by MAC address on the firewall
D) Rely on split tunneling to reduce backhaul traffic
👁 Reveal Answer
Correct Answer: B
Explanation: Zero trust replaces implicit “trust the internal network” logic with continuous verification. Each request should be evaluated against identity, device posture, and context. As a result, the session is granted the smallest scope of access needed for the task. Option A repeats the old perimeter model. Option C confuses network hygiene with identity assurance and is trivially spoofed. Option D is a routing decision, not an access control. On the SY0-701 exam, watch for the phrase “no implicit trust” — that is your zero trust signal.
Question 3: Gaining Visibility Across SaaS Apps
Fabrikam’s security team has lost visibility into which SaaS apps employees use and what data they upload. They need a control that inspects sanctioned and unsanctioned SaaS traffic, applies DLP, and enforces adaptive policies. Which control best fits this cloud security architecture gap?
A) Network intrusion detection system on the internet gateway
B) Cloud Access Security Broker with API and inline modes
C) Traditional web content filter on the perimeter proxy
D) Endpoint antivirus with signature-based scanning
👁 Reveal Answer
Correct Answer: B
Explanation: A Cloud Access Security Broker (CASB) is purpose-built for SaaS visibility, shadow IT discovery, DLP, and policy enforcement. Specifically, it can operate inline as a proxy or via API integrations with sanctioned apps like Microsoft 365 and Salesforce. NIDS (A) sees flows, not SaaS actions. A web content filter (C) blocks URLs but does not inspect SaaS activity semantics. Endpoint AV (D) does not address the SaaS layer at all. When the exam mentions “shadow IT” or “SaaS DLP,” think CASB first.
Question 4: Segmenting a Three-Tier Cloud Application
The architecture team at Northwind Traders is deploying a three-tier web app to a public cloud. They need to make sure the database tier is not directly reachable from the internet, even if the web tier is compromised. Which design provides the tightest blast radius?
A) Place all tiers in one public subnet and rely on OS firewalls
B) Separate tiers into public, private-app, and private-data subnets with tiered security groups
C) Expose the database directly to the internet but require a strong password
D) Use a single security group that allows any-to-any inside the VPC
👁 Reveal Answer
Correct Answer: B
Explanation: Segmenting each tier into its own subnet with tightly scoped security groups (or NSGs) enforces defense in depth. Specifically, the database subnet should only accept traffic from the app tier on the required port, never from the internet. Option A collapses trust boundaries. Option C is a classic exam trap — a strong password is never a substitute for network isolation. Option D creates flat, any-to-any trust that lets a single compromise pivot everywhere. In addition, this layered pattern aligns cleanly with zero trust microsegmentation.
Question 5: Least Privilege for Cloud Service Accounts
Woodgrove Bank runs an internal audit that finds dozens of application service accounts holding administrator-equivalent roles in the cloud tenant. Which change most directly reduces the blast radius if one of those accounts is compromised?
A) Rotate the account passwords every 30 days
B) Replace the accounts with a single shared super-admin account
C) Right-size each account to only the permissions it actually uses
D) Add the accounts to a mailing list for audit notifications
👁 Reveal Answer
Correct Answer: C
Explanation: Least privilege is the single most effective control against lateral movement and credential abuse. Therefore, applying it to service accounts limits what any compromise can actually do and shrinks blast radius. Password rotation (A) is useful, however it does not reduce the scope of damage once a valid credential is used. A shared super-admin (B) is the opposite of least privilege. Notifications (D) may help detection but do nothing to reduce exposure. On the exam, “reduce blast radius” and “least privilege” almost always travel together.
Question 6: Multicloud Security Posture Management
Litware operates production workloads in both AWS and Microsoft Azure, and the CISO is tired of security analysts pivoting between two consoles to triage misconfigurations. Leadership wants a single view of findings prioritized in one format. Which control best fits this cloud security architecture need?
A) Manually export CSV reports weekly from each provider
B) A cross-cloud posture platform (CSPM/CNAPP) that normalizes findings
C) A traditional SIEM that only ingests network flow logs
D) Separate ticketing queues for AWS and Azure with no correlation
👁 Reveal Answer
Correct Answer: B
Explanation: Cloud Security Posture Management (or a broader Cloud-Native Application Protection Platform) is designed to inventory resources across CSPs, evaluate them against benchmarks, and normalize findings. As a result, analysts triage one prioritized queue instead of toggling consoles. This is exactly the pattern AWS embraced when it extended Security Hub to Azure workloads in July 2026. CSV exports (A) are stale by the time they are opened. A flow-only SIEM (C) misses configuration risk, and (D) preserves the very fragmentation leadership wants to fix.
Question 7: Securing Container Images Before Deployment
Adventure Works packages its microservices as container images and pushes them to a registry that feeds a managed Kubernetes cluster. Recent audits revealed several images running with outdated OpenSSL versions. Which control most reduces the chance of shipping vulnerable images to production?
A) Scan images in the registry and block promotion of images with critical CVEs
B) Rely on runtime firewalls to block exploits after deployment
C) Rebuild every image from scratch nightly with no automated checks
D) Increase pod CPU limits so containers can absorb attacks
👁 Reveal Answer
Correct Answer: A
Explanation: Shift-left image scanning integrated into the CI/CD pipeline or registry admission policies stops vulnerable images from ever reaching production. Specifically, blocking promotion on critical findings enforces the guardrail rather than relying on humans to notice. Runtime firewalls (B) are useful but reactive and cannot patch a known CVE inside the image. Nightly rebuilds (C) without scanning still ship vulnerabilities. CPU limits (D) address performance, not security. This is a classic supply chain security control on the SY0-701 exam.
Question 8: Managing Secrets in a Serverless Function
Tailwind Traders’ serverless team stores database credentials as plaintext environment variables inside Lambda functions. Security wants short-lived credentials that never appear in code or logs. Which change should the team make?
A) Move the plaintext credentials into the function code itself
B) Retrieve credentials at runtime from a managed secrets service using an IAM role
C) Email the credentials to developers each morning
D) Store credentials in a public S3 bucket with a hard-to-guess name
👁 Reveal Answer
Correct Answer: B
Explanation: A managed secrets service (for example, AWS Secrets Manager or Azure Key Vault) lets the function assume an IAM role, retrieve the secret at runtime, and rotate it centrally. Consequently, no plaintext credential lives in code, config, or CI logs. Option A is worse than the starting state. Option C creates a permanent audit trail of credentials in mailboxes. Option D relies on “security through obscurity,” which is not a control. The exam will consistently reward centralized secrets management with rotation over any hand-rolled approach.
Question 9: SASE for a Hybrid Bank Workforce
A regional bank has offices, branches, and remote employees who all need consistent access to SaaS, IaaS, and on-prem apps. The CIO wants unified networking and security policy at the edge, not a stack of point products. Which model best meets this cloud security architecture goal?
A) Backhaul all traffic to a single headquarters firewall
B) Deploy SASE that combines SD-WAN with cloud-delivered SWG, CASB, ZTNA, and FWaaS
C) Purchase separate appliances for each branch and remote user
D) Rely only on endpoint antivirus at each device
👁 Reveal Answer
Correct Answer: B
Explanation: Secure Access Service Edge (SASE) converges networking and security into a cloud-delivered service. Specifically, it combines SD-WAN with Secure Web Gateway, CASB, Zero Trust Network Access, and Firewall-as-a-Service so policy follows the user rather than the location. Option A creates a chokepoint and adds latency for SaaS users. Option C fragments policy and multiplies operational cost. Option D covers only one layer. When the exam says “unified edge for hybrid workforce,” SASE is the answer.
Question 10: Centralizing Logs Across Multiple Clouds
The central SOC at Tailspin Toys collects logs from AWS, Azure, and on-prem systems, but analysts complain that cross-cloud investigations take hours because timestamps and schemas differ. Which design most improves detection and response speed?
A) Keep each cloud’s logs in its native console and search separately
B) Stream all logs to a central SIEM using a common schema and normalized time source
C) Only store the last 24 hours of logs to save on storage costs
D) Rely on individual admins to email suspicious log entries
👁 Reveal Answer
Correct Answer: B
Explanation: Centralized log aggregation into a SIEM with a normalized schema (for example, OCSF or ECS) and a synchronized time source is the foundation of multicloud detection engineering. As a result, analysts pivot across providers using one query language and consistent field names. Option A recreates the exact fragmentation that slows investigations. Option C prevents any meaningful long-tail incident analysis. Option D is not a control. In addition, the SY0-701 exam expects you to recognize centralization and normalization as prerequisites for effective SOC operations.
Study Tips to Strengthen Your Cloud Security Architecture Skills
Use these focus areas as you continue preparing for SY0-701 Domain 3:
- Memorize the shared responsibility model for IaaS, PaaS, and SaaS side by side. For example, the exam loves to test where the line moves between models.
- Practice mapping business constraints (latency, blast radius, cost, compliance) to a single “best fit” control rather than a general concept.
- Draw a simple zero trust diagram from memory: identity, device posture, policy engine, and enforced least privilege.
- Get comfortable with the vocabulary of CSPM, CNAPP, CASB, SASE, ZTNA, and SIEM. Confusing them costs easy points.
- Read one recent cloud incident postmortem each week. Then identify which control would have prevented it.
- Learn to spot exam distractors that trade real controls for procedural fixes such as email notifications, obscurity, or manual CSV exports. Those are almost always wrong.
- Practice explaining CSPM, CNAPP, CASB, and SASE out loud in one sentence each. If you cannot, you do not yet own the term for the exam.
Finally, treat every scenario as a “why this one, not that one” exercise. The SY0-701 blueprint rewards candidates who can justify a choice against a specific business constraint. Therefore, drill until the constraint jumps off the page before you even read the options. That habit is the difference between guessing and knowing.
Keep Practicing Cloud Security Architecture
Consistent daily reps are the single strongest predictor of a first-attempt pass on Security+. Therefore, come back tomorrow for the next batch of cloud security architecture scenarios. In the meantime, dig deeper with our related practice sets on AZ-305 Identity Governance and Monitoring patterns, the SAA-C03 Gateway Endpoint cost pattern, and the fundamentals covered in AZ-900 Identity, Security, and Network Protection. For authoritative guidance on the current SY0-701 blueprint, review the official CompTIA Security+ certification page.