Free Architecture Models practice questions
10 free SY0-801 questions on Architecture Models, each with a full explanation — no account needed. This section sits in the Security Architecture part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
A manufacturer runs its plant scheduling system in its own data center and its online store on one public cloud provider. A private link and a shared sign-in service connect the two environments. Which deployment model describes this design?
Connecting on-premises infrastructure with a public cloud so identities, data and workloads move between them is a hybrid cloud. Multicloud is the tempting answer, but it means using two or more public cloud providers, and this company uses only one. Private and community clouds each describe a single environment rather than a connected mix.
A company moves its customer relationship management system from servers it ran itself to a SaaS product. Which security task does the company still perform after the move?
In SaaS the provider runs everything technical, but the customer always owns its identities, sharing settings and data, so enforcing MFA and restricting external sharing stay with the company. Operating system patching, the application's code and the hypervisor all belong to the SaaS provider.
A hospital stores patient records in a public cloud storage service and leaves one storage bucket readable by anyone on the internet. The records are exposed. Who is accountable to regulators for the exposure?
Handing storage to a provider hands over work, not accountability, and a bucket left open to the public is a customer configuration failure in any service model. Blaming the provider because the data sat on its servers is the classic trap: hosting data doesn't make the provider responsible for who can read it.
A team moves an internal application from a PaaS platform to a SaaS product that does the same job. Which security responsibility moves from the customer to the provider with that change?
In PaaS the customer still owns its application code and dependencies, and in SaaS the provider runs the application too, so that layer moves. Operating system patching already belonged to the provider under PaaS, and identities, access settings and data stay with the customer in every cloud model.
A company uses a SaaS suite for email and file storage, yet its security team still pays for a separate backup service for that SaaS data. What is the BEST reason?
The provider keeps the service running, but many SaaS providers don't promise to recover an item a user deleted after the retention window closes, and protecting the data stays the customer's job. Patching belongs to the SaaS provider, and no backup or contract moves accountability for the data away from the customer.
In a microservices application, the order service calls the inventory service, which calls the pricing service, all inside the same cluster. What is this service-to-service traffic called?
Traffic between services inside the application is east-west traffic, and in microservices it often far exceeds the traffic from users. North-south traffic flows between users and the application, usually through an API gateway, which is why a gateway alone does nothing for calls between services.
During an incident, an engineer closes an exposed port by hand in the cloud console. The Terraform template that built the environment still opens that port. What will MOST likely happen the next time the template is applied?
The live environment has drifted from the code, and applying the unchanged template undoes the drift, so the protective console fix silently disappears. Terraform's plan output warns that objects changed outside the tool, but nothing copies the change into the template, which is why emergency changes must be written back into the code.
Attackers flood a company's serverless API with requests. The service stays up because the platform scales automatically, but the month's cloud bill rises to 40 times normal. Which controls would BEST contain this?
Automatic scaling turns a flood of requests into a denial of wallet, where the bill is the damage, and concurrency limits with budget alerts contain it. The customer has no host operating system to patch and no host on which to install an EDR agent, and environment variables are a weaker home for secrets, not a cost control.
A company runs workloads on three public cloud providers and plans to keep all three. Each has its own identity model, logging format and default network settings. Which approach BEST addresses the security challenge this creates?
The multicloud challenge is keeping one consistent policy across platforms, so a single identity provider federated to every cloud and central logging into one SIEM are the core controls. Defaults differ between providers, and some, such as a default network that allows SSH and RDP from anywhere, aren't safe. Separate teams with native tools create the very inconsistency the company needs to avoid.
A team moves an image-processing service from virtual machines it manages to serverless functions. Which security task does the team no longer perform after the move?
With serverless the provider patches the hosts and the managed runtime, so host operating system patching leaves the team's list. The team still owns its code and third-party libraries, must move to a newer runtime version when the old one is retired, and must treat every trigger's event data as untrusted input.
Study this section
Every lesson that covers Architecture Models on the SY0-801 exam.