SY0-701 Security Architecture Practice Question
A company needs a public website that anyone on the internet can reach, but the application and database servers must stay off the internet. Where should the web server be placed?
⚠ Common exam trap
It's easy for candidates to confuse a DMZ with a 'public subnet' and think placing the web server directly on the internet-facing side of the firewall is sufficient, but the DMZ is a separate, isolated network segment that enforces strict traffic inspection and prevents direct lateral movement to internal resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In a DMZ separated from the internal application and database networks.
The web server must be placed in a DMZ (demilitarized zone) because this network segment is designed to host publicly accessible services while isolating them from internal networks. The DMZ allows inbound traffic from the internet to the web server, but the application and database servers remain on internal networks with strict firewall rules that block direct internet access, enforcing a layered security architecture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
On the internal user network with the database server.
Why it's wrong here
Placing a public web server on the internal user network alongside the database collapses the trust boundary, forcing internet-facing traffic into the trusted zone with no intermediate filtering. If the web server is exploited, the attacker gains immediate lateral access to the database and to every workstation on that segment, potentially exfiltrating data or deploying ransomware. This violates the principle of least privilege and defense in depth, because a single compromised web-facing process should not provide a direct path to internal assets.
- ✓
In a DMZ separated from the internal application and database networks.
Why this is correct
A DMZ is the best choice because it allows public access to the web server while keeping the application and database tiers behind additional security controls. If the web server is compromised, the attacker still has to cross another boundary to reach internal systems. This layered zoning is a standard architecture pattern for public-facing services and helps contain risk.
- ✗
On the same subnet as the firewall management interface.
Why it's wrong here
Combining a public web server with the firewall management interface subnet is a critical security design error: management interfaces are the administrative plane that controls routing and security policy, and they must be restricted to authorized administrators via out-of-band channels. Putting an internet-exposed service on that subnet means an attacker who breaches the web server can sniff management traffic, launch ARP spoofing, or directly attack the management interface, potentially taking over the firewall and neutralizing all perimeter defenses. This violates the security best practice of separating management traffic from all other traffic, especially south-north web traffic.
- ✗
Directly on the database subnet so performance is faster.
Why it's wrong here
Placing the web server directly on the database subnet trades security for a negligible performance gain, exposing the database to any exploit that compromises the web tier. In a correctly layered architecture, the database should only accept connection attempts from the application tier through a firewall policy that permits specific source IPs and ports, not from an internet-facing server. Real performance gains come from indexing, query optimization, and application-level caching, not from network proximity, so this choice creates a serious blast radius without a real performance benefit.
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
DMZ
A DMZ (demilitarized zone) is a network segment that sits between an internal private network and the public internet, hosting publicly accessible services while keeping the internal network isolated.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.