SY0-701 Security Architecture Practice Question
A help desk team wants guest Wi-Fi users to access only the internet and nothing on the internal corporate network. Which control should the network team implement at the wireless edge?
⚠ Common exam trap
Watch out — candidates often confuse authentication controls (passwords, passphrase rotation) with network access controls (ACLs, firewall rules), assuming that a strong password or DNS server can prevent lateral movement, when in fact only explicit Layer 3/4 filtering at the edge can enforce network segmentation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An ACL or firewall rule set that blocks guest network access to internal subnets
To prevent guest Wi-Fi users from accessing the internal corporate network while allowing internet access, the network team must implement an ACL or firewall rule set at the wireless edge. This control explicitly blocks traffic from the guest VLAN/subnet to internal subnets (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) while permitting outbound traffic to the internet. This is a fundamental network segmentation technique that enforces the principle of least privilege at Layer 3/4.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A single shared password for all guest users
Why it's wrong here
A shared Wi-Fi password is an authentication credential, not a Layer 3 traffic enforcement mechanism. It grants any holder of the passphrase access to the guest SSID but does nothing to restrict where that guest device can send packets. Unless an ACL or firewall rule is applied elsewhere, a guest can still reach internal corporate subnets simply because those subnets are routable from the guest VLAN.
- ✓
An ACL or firewall rule set that blocks guest network access to internal subnets
Why this is correct
An ACL or firewall rule set is the correct control because it operates at the network layer, where routing and reachability are decided. By placing guest traffic into a separate VLAN and applying rules on the guest default gateway or firewall, the help desk can permit internet-bound traffic while explicitly denying traffic destined to internal RFC 1918 subnets. This is exactly the kind of destination-based restriction that meets the requirement that guest users access only the internet.
- ✗
A stronger DNS server
Why it's wrong here
A stronger DNS server is a name-resolution service, not a packet-filtering enforcement point. Even a highly secure, fast DNS server will still resolve queries for internal hosts, and guests can bypass DNS entirely by connecting to internal systems using their IP addresses. DNS security features like DNSSEC protect against spoofing and cache poisoning, but they have no effect on whether a guest packet is routed into the corporate network.
- ✗
A longer Wi-Fi passphrase rotated monthly
Why it's wrong here
Rotating a longer Wi-Fi passphrase monthly strengthens link-layer authentication by making it harder for unauthorized users to learn the pre-shared key. However, once a guest has successfully authenticated and is associated to the network, the passphrase has no further role in determining which destinations that guest can reach. The guest's existing network path to internal subnets remains open unless a distinct filtering rule or ACL is implemented at the gateway or firewall.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
VLAN
A VLAN (Virtual Local Area Network) is a logical grouping of network devices that behave as if they are on the same physical network segment, regardless of their actual physical location.
Key term
ACL
An Access Control List is a set of rules that determines who or what can access specific network resources or data.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.