SY0-701 Security Architecture Practice Question
A company wants guest laptops on Wi-Fi to reach the internet but not internal printers or servers. Which two changes best support this design? Select two.
⚠ Common exam trap
A common mix-up: candidates think VLAN separation alone is sufficient, forgetting that a Layer 3 gateway (router/firewall) can still route between VLANs unless explicit ACLs or firewall rules block RFC1918 destinations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign guest access points to a separate VLAN with its own subnet.
Assigning guest access points to a separate VLAN with its own subnet isolates guest traffic at Layer 2, preventing direct communication with internal devices like printers and servers. This segmentation is a foundational step for enforcing access control policies without relying solely on higher-layer filtering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign guest access points to a separate VLAN with its own subnet.
Why this is correct
A separate VLAN and subnet keep guest devices logically isolated from corporate systems. This is a common first step in segmentation because it limits what guest traffic can reach and makes firewall policy easier to enforce.
- ✗
Allow guests on the same VLAN as employee devices for simpler routing.
Why it's wrong here
Placing guest laptops on the same VLAN as employee devices would give them unrestricted Layer 2 access to internal printers and servers, directly violating the requirement to block that traffic. This option is tempting because a single VLAN simplifies routing and switch configuration, and it would be correct in a scenario where all devices on the network share the same trust level and no segmentation is required.
- ✓
Use firewall rules to deny guest traffic to internal RFC1918 address ranges.
Why this is correct
A stateful firewall policy should deny guest VLAN traffic to any RFC1918 destination (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) while permitting established connections out to public internet. This control operates at layer 3/4 and enforces the boundary after the guest subnet, but it must be paired with a separate VLAN to ensure guest traffic actually traverses the firewall rather than being bridged at layer 2. It is an effective second layer of defense because even if a guest device is compromised, it cannot directly initiate sessions to internal corporate hosts using private addressing.
- ✗
Enable WPA2-Enterprise on employee wireless only, and reuse that on guest devices.
Why it's wrong here
WPA2-Enterprise authenticates users through 802.1X/RADIUS, but authentication alone does not grant or deny network access to specific subnets; once a client is associated and authenticated, it remains on the same broadcast domain unless a VLAN or ACL is assigned. Reusing the enterprise SSID/credentials for guests means untrusted devices are authenticated with the same trust level as employees, and shared credentials could expose enterprise accounts if given to guests. The actual requirement is isolation from internal resources, which is a network-layer decision, not an encryption or authentication property.
- ✗
Put printers on the guest VLAN so guests can print directly.
Why it's wrong here
Placing printers on the guest VLAN directly exposes corporate assets to untrusted users; printers frequently have open administrative ports, unpatched firmware, and stored print jobs that can contain confidential data, making them attractive targets for lateral movement or exfiltration. This approach also defeats the purpose of guest segmentation by intentionally giving guests logical access to internal systems, and it does nothing to restrict traffic to other internal resources. Print services for guests should instead be provided through a secured print server that mediates access without placing the actual printer on the untrusted network.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
VLAN
A VLAN (Virtual Local Area Network) is a logical grouping of network devices that behave as if they are on the same physical network segment, regardless of their actual physical location.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Guest tablets in a conference room use the same physical switches as employee devices. The security team wants guests to have internet access only, with no route to internal subnets. Which design best meets the goal?
easy- A.Keep guests on the same VLAN and rely on a separate Wi-Fi password.
- ✓ B.Place guests on a separate VLAN and block internal access with ACLs.
- C.Use stronger WPA3 encryption on the wireless network and leave the network flat.
- D.Enable MAC address filtering on the switch and allow all ports to remain in the default network.
Why B: Placing guest tablets on a separate VLAN segments traffic at Layer 2, and applying ACLs on the Layer 3 interface (SVI or router) blocks all routes to internal subnets while permitting internet access. This design ensures that even though guests share the same physical switches, their traffic is isolated from employee VLANs and cannot reach internal resources.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.