SY0-701 Security Architecture Practice Question
A company's current remote access solution uses a traditional VPN that grants users full network-layer access to the internal LAN once authenticated. The security architect wants to adopt a zero trust architecture to reduce the risk of lateral movement by compromised endpoints. Which of the following implementations best aligns with zero trust principles?
⚠ Common exam trap
It's easy for candidates to confuse 'stronger authentication' (MFA) or 'better firewalling' (NGFW) with zero trust, but zero trust requires eliminating implicit trust at the network layer by granting access only to specific applications, not the entire LAN.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a software-defined perimeter that authenticates each user and device before granting access only to specific applications.
A software-defined perimeter (SDP) implements zero trust by authenticating both the user and device before granting access to specific applications, not the entire network. This prevents lateral movement by ensuring that even after authentication, the endpoint can only reach the allowed application, not the full LAN. This aligns with the zero trust principle of 'never trust, always verify' and micro-segmentation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a next-generation firewall and require all remote traffic to pass through it with strict rules.
Why it's wrong here
A next-generation firewall provides deep packet inspection and policy enforcement, but still operates at the network layer. Remote users who authenticate are granted network-level access, which does not align with the zero trust principle of granting access only to specific applications on a per-session basis.
When this WOULD be correct
This option would be correct if the question asked for a solution to improve network security by segmenting traffic and enforcing application-level controls without changing the VPN architecture, or if the goal was to replace an outdated firewall with a more advanced one for better traffic inspection.
- ✗
Deploy a secure web gateway and require all remote users to browse through a proxy.
Why it's wrong here
A secure web gateway (SWG) primarily secures web traffic and can enforce URL filtering and malware inspection. It does not replace the need for application-specific access control and still allows broad network access after authentication, which is contrary to zero trust's micro-segmentation requirement.
When this WOULD be correct
This option would be correct if the question focused on securing web traffic for remote users, such as 'A company wants to enforce acceptable use policies and block malicious websites for remote employees. Which solution best achieves this?' In that context, an SWG with proxy is appropriate.
- ✓
Use a software-defined perimeter that authenticates each user and device before granting access only to specific applications.
Why this is correct
A software-defined perimeter (SDP) or zero trust network access (ZTNA) solution authenticates and authorizes each connection request individually, creating an encrypted tunnel only to the requested application. This prevents lateral movement because the user never receives a network-level address on the internal LAN.
- ✗
Enable multi-factor authentication for VPN and implement a VPN concentrator with split tunneling.
Why it's wrong here
Multi-factor authentication strengthens the authentication step, but once the MFA challenge is passed, the VPN still grants full network-layer access to the LAN. Split tunneling can even expose the internal network to additional risks. This does not satisfy the zero trust requirement of granular, per-resource access control.
When this WOULD be correct
This option would be correct in a scenario where the goal is to improve authentication security for an existing VPN without changing the network access model, such as reducing credential theft risks while maintaining full LAN access for legacy applications.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use a software-defined perimeter that authenticates each user and device before granting access only to specific applications.Correct answer▾
Why this is correct
A software-defined perimeter (SDP) or zero trust network access (ZTNA) solution authenticates and authorizes each connection request individually, creating an encrypted tunnel only to the requested application. This prevents lateral movement because the user never receives a network-level address on the internal LAN.
✗Implement a next-generation firewall and require all remote traffic to pass through it with strict rules.Wrong answer — click to see why▾
Why this is wrong here
A next-generation firewall with strict rules still provides network-layer access to the entire LAN after authentication, which does not prevent lateral movement by compromised endpoints. Zero trust requires per-request, least-privilege access to specific resources, not broad network access.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a solution to improve network security by segmenting traffic and enforcing application-level controls without changing the VPN architecture, or if the goal was to replace an outdated firewall with a more advanced one for better traffic inspection.
Why candidates choose this
Candidates may think that a next-generation firewall with strict rules is sufficient to enforce zero trust, but they overlook that zero trust requires granular, per-session access to specific applications rather than network-layer access.
✗Deploy a secure web gateway and require all remote users to browse through a proxy.Wrong answer — click to see why▾
Why this is wrong here
A secure web gateway (SWG) primarily filters web traffic and enforces policies for web-based applications, but it does not provide per-application, identity-aware access control for all remote resources. It still typically operates at the network layer and does not fully implement zero trust's principle of least privilege for individual applications.
★ When this WOULD be the correct answer
This option would be correct if the question focused on securing web traffic for remote users, such as 'A company wants to enforce acceptable use policies and block malicious websites for remote employees. Which solution best achieves this?' In that context, an SWG with proxy is appropriate.
Why candidates choose this
Candidates may confuse a secure web gateway with a zero trust solution because both involve granular control and identity verification, but an SWG is limited to web traffic and does not cover all remote access scenarios required for zero trust.
✗Enable multi-factor authentication for VPN and implement a VPN concentrator with split tunneling.Wrong answer — click to see why▾
Why this is wrong here
Enabling MFA for VPN and using split tunneling still grants full network-layer access to the LAN after authentication, which violates zero trust's principle of least privilege and does not prevent lateral movement by compromised endpoints.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the goal is to improve authentication security for an existing VPN without changing the network access model, such as reducing credential theft risks while maintaining full LAN access for legacy applications.
Why candidates choose this
Candidates may think that adding MFA and split tunneling enhances security enough to align with zero trust, but they overlook that zero trust requires per-request micro-segmentation and application-specific access, not just stronger authentication at the network perimeter.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.