easyMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A security architect is designing a secure…
A security architect is designing a secure enclave for a high-value application. Which of the following is the BEST approach to isolate the application from the rest of the network?
⚠ Common exam trap
Test-takers frequently confuse network isolation with access control or monitoring, picking a VLAN/ACL (Option D) because it provides segmentation, but failing to recognize that a stateful firewall with DMZ architecture is the only option that enforces bidirectional traffic filtering and stateful inspection, which is essential for a secure enclave.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy the application in a DMZ behind a stateful firewall with least-privilege rules.
A DMZ behind a stateful firewall with least-privilege rules provides network-level isolation by placing the application in a separate security zone that restricts inbound and outbound traffic to only necessary ports and protocols. The stateful firewall tracks connection states, preventing unauthorized traffic from reaching the enclave while allowing legitimate responses. This approach directly addresses the requirement to isolate the application from the rest of the network, as the DMZ acts as a buffer between the internal network and the application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy the application in a DMZ behind a stateful firewall with least-privilege rules.
Why this is correct
A DMZ enclave with a stateful firewall ensures strict network isolation and policy enforcement, which is the best practice for high-value applications.
- ✗
Install an intrusion detection system (IDS) on the application subnet.
Why it's wrong here
IDS provides monitoring but does not prevent direct network access to the application; it is not an isolation technique.
- ✗
Configure a jump box with two-factor authentication to access the application.
Why it's wrong here
A jump box controls administrative access but does not isolate the application from network-based attacks.
- ✗
Place the application on a separate VLAN with an ACL.
Why it's wrong here
VLANs provide logical separation but can be compromised via VLAN hopping or misconfiguration; they do not offer the same security as a DMZ enclave.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.