SY0-701 Security Architecture Practice Question
A branch office has users, finance workstations, printers, and IP phones on one flat network. The security team wants to reduce lateral movement if one user PC is compromised, but printers still need to receive print jobs from users. What is the best design change?
⚠ Common exam trap
Candidates often choose Option C, mistakenly thinking that consolidating printers into the finance VLAN simplifies management, but they overlook that printers are notoriously insecure and would become a bridge for lateral movement into the finance segment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place finance systems and user devices in separate VLANs and allow only the necessary print and business application traffic through filtering rules.
Segmenting the flat network into separate VLANs for finance systems and user devices enforces network segmentation, which limits lateral movement. By using VLANs and firewall rules to allow only necessary traffic (e.g., print jobs via IPP or SMB, and business application traffic), the organization reduces the attack surface while maintaining required functionality. This aligns with the principle of least privilege and zero trust architecture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Keep one flat network and increase endpoint antivirus scanning frequency.
Why it's wrong here
Increasing antivirus scanning frequency does not segment the flat network, so an attacker who compromises one user PC can still use ARP spoofing or broadcast-based discovery to reach finance workstations and IP phones directly. This option is tempting because antivirus is a standard defence against malware, and in a scenario where the threat is purely file-based malware propagation rather than network-layer lateral movement, more frequent scanning would reduce infection spread.
- ✓
Place finance systems and user devices in separate VLANs and allow only the necessary print and business application traffic through filtering rules.
Why this is correct
This design reduces lateral movement by separating high-value systems from general user devices. VLANs create logical segmentation, and targeted filtering permits only the traffic required for printing and approved business flows. It preserves functionality while sharply reducing the number of systems reachable after a compromise.
- ✗
Move all printers into the finance VLAN to avoid managing inter-VLAN rules.
Why it's wrong here
Although consolidating printers into the finance VLAN reduces inter-VLAN configuration, it broadens the sensitive subnet's layer 2 attack surface. Printers frequently run outdated firmware and open management ports (SNMP, JetDirect, HTTP) that are prime targets for lateral movement, credential harvesting, or interception of print jobs. Moreover, user workstations still need to print, so you would either need filtering rules from the user VLAN to finance, or you would have to move user devices too — subverting the intended separation. The correct approach is to isolate finance systems and treat printers as untrusted endpoints with dedicated VLANs and strict ACLs.
- ✗
Disable printing so user workstations cannot communicate with any other device.
Why it's wrong here
Disabling printing eliminates a legitimate business service without achieving any security benefit for the remaining attack paths. User workstations would still share the same flat IPv4 subnet with finance systems and IP phones, so ARP spoofing, broadcast-based discovery, and VLAN hopping remain viable, allowing an attacker to pivot from a compromised PC to sensitive targets. This measure also introduces high operational friction, forcing users to find unsupported alternatives while doing nothing to contain a breach. Proper network segmentation and least-privilege filtering address the root cause without sacrificing required functionality.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
SMB
SMB is a network file-sharing protocol that allows applications to read, write, and request services from server programs in a computer network.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.