SY0-701 Security Architecture Practice Question
A branch office has users, finance workstations, and printers on the same LAN. Management wants finance devices isolated from general users while still allowing approved printing and internet access. Which two changes best meet this goal? Select two.
⚠ Common exam trap
Watch out — candidates often think VLANs alone provide security, forgetting that inter-VLAN routing is enabled by default on most switches, so ACLs or firewall rules are mandatory to actually restrict traffic between VLANs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Put finance systems in a separate VLAN.
Placing finance systems in a separate VLAN (Option A) segments the LAN into isolated broadcast domains, preventing general users from directly accessing finance workstations at Layer 2. This is a foundational step for network segmentation, as VLANs logically separate traffic without requiring physical re-cabling.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Put finance systems in a separate VLAN.
Why this is correct
Creating a separate VLAN for finance systems establishes a Layer 2 logical boundary that isolates broadcast domains and restricts ARP-based reconnaissance. Any inter-VLAN traffic must be routed through a Layer 3 device, which inherently reduces lateral movement and allows the finance segment to be governed by distinct security policies, such as stricter access controls and monitoring. This is the foundational step for network segmentation and directly supports compliance requirements like PCI DSS.
- ✓
Use firewall or ACL rules between the VLANs.
Why this is correct
Firewall or ACL rules between the VLANs provide the policy enforcement that makes segmentation effective. Without these rules, inter-VLAN routing would simply allow unrestricted communication, nullifying the separation. Carefully crafted allow-lists permit only specific protocols like IPP (print), SMB (file sharing), and DNS while blocking all other traffic, ensuring that finance systems are reachable only for required business functions and preserving both usability and security.
- ✗
Remove the default gateway from all finance devices.
Why it's wrong here
Removing the default gateway on finance devices is not a segmentation strategy; it is a blackout that breaks all off-subnet communication, including internet access, DNS resolution, and inter-VLAN traffic. It does not selectively restrict access to specific resources—it globally disables routed connectivity, which would halt legitimate business operations and create an administrative burden. Security controls should enforce least privilege, not eliminate functionality entirely.
- ✗
Place all systems in one flat subnet.
Why it's wrong here
Placing all systems in one flat subnet eliminates any network-level isolation, placing all hosts in the same broadcast domain and allowing direct host-to-host communication. Lateral movement becomes trivial because an attacker who compromises one user workstation can freely probe and reach finance devices without traversing any enforcement point. This approach also violates security best practices like microsegmentation and significantly expands the PCI DSS compliance scope.
- ✗
Use hubs instead of switches to simplify traffic flow.
Why it's wrong here
Using hubs instead of switches would severely degrade network security and is contrary to the goal of segmentation. Hubs operate at Layer 1 and replicate every incoming signal to every port, so all connected devices can eavesdrop on all traffic, including finance data. Switches, by contrast, isolate traffic based on MAC addresses, providing a basic form of data confidentiality; hubs remove even that, replacing it with a literal broadcast medium that amplifies interception risks.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
VLAN
A VLAN (Virtual Local Area Network) is a logical grouping of network devices that behave as if they are on the same physical network segment, regardless of their actual physical location.
Key term
Network segmentation
Network segmentation is the practice of dividing a computer network into smaller, isolated parts to improve performance, contain security threats, and simplify management.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.