Question 495 of 1,152

Security Architecture →mediumMultiple ChoiceObjective-mapped

Quick Answer

The correct design is to create separate VLANs for guest, staff, and medical devices, then enforce traffic rules between them with firewall policies. This works because VLAN segmentation on a wireless network isolates each group into its own logical broadcast domain, preventing direct communication between guest, staff, and medical device traffic at Layer 2, while firewall rules (such as ACLs or stateful inspection) provide granular Layer 3 control—allowing medical devices to talk only to the monitoring server, guests only to the internet, and staff to internal apps, all with minimal operational complexity. On the Security+ SY0-701 exam, this scenario tests your understanding of network segmentation and firewall policy design, often appearing as a multi-VLAN question with a trap answer suggesting separate physical access points or a single flat network. Remember the mnemonic "VLANs for isolation, firewalls for direction"—VLANs keep traffic apart, firewalls decide where it can go.

SY0-701 Security Architecture Practice Question

This SY0-701 practice question tests your understanding of security architecture. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A hospital is redesigning its wireless network. Guest devices must reach only the internet. Staff laptops need access to internal applications. Medical devices must communicate with a monitoring server but never with guest devices or the broader employee LAN. What design best meets these goals with the least operational complexity?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Clue: "least"
Why it matters: You want the option with minimum overhead, fewest steps, or lowest impact — not the most feature-rich or comprehensive answer.
Clue: "never"
Why it matters: Absolute qualifier. True only if the statement has zero exceptions — be cautious of options that seem obvious but break down in edge cases.

Question 1mediummultiple choice

Read the full wireless explanation →

A
Place all devices on one flat network and rely on endpoint antivirus for protection.
Why wrong: A flat network makes lateral movement easier and does not enforce separation between trust zones. Antivirus can help on endpoints, but it does not prevent guest systems from reaching internal resources or medical devices from talking to unrelated hosts.
B
Create separate VLANs for guest, staff, and medical devices, then enforce traffic rules between them with firewall policies.
This approach provides clean segmentation while keeping administration manageable. Separate VLANs define distinct trust zones, and firewall policies or ACLs control exactly which services can cross boundaries. That lets guest traffic stay internet-only, staff reach approved internal apps, and medical devices communicate only with the monitoring server.
C
Use a single wireless SSID with client isolation enabled and NAT all traffic through one gateway.
Why wrong: Client isolation limits peer-to-peer access on the same wireless segment, but it does not create strong separation between guest, staff, and medical systems. NAT also does not provide the granular policy control needed to restrict medical-device communications.
D
Deploy network access control only at login time and allow all devices onto the same internal subnet afterward.
Why wrong: NAC can help with admission control, but if all devices share the same subnet afterward, they remain able to communicate more broadly than intended. That weakens segmentation and makes policy enforcement much harder.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create separate VLANs for guest, staff, and medical devices, then enforce traffic rules between them with firewall policies.

Option B is correct because VLANs logically segment the network into isolated broadcast domains for guest, staff, and medical devices, while firewall policies (e.g., using ACLs or stateful inspection) enforce granular traffic rules. This design ensures medical devices can only communicate with the monitoring server, guests are restricted to internet-only access, and staff can reach internal applications, all without requiring complex physical reconfiguration.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Place all devices on one flat network and rely on endpoint antivirus for protection.
Why it's wrong here
A flat network makes lateral movement easier and does not enforce separation between trust zones. Antivirus can help on endpoints, but it does not prevent guest systems from reaching internal resources or medical devices from talking to unrelated hosts.
✓
Create separate VLANs for guest, staff, and medical devices, then enforce traffic rules between them with firewall policies.
Why this is correct
This approach provides clean segmentation while keeping administration manageable. Separate VLANs define distinct trust zones, and firewall policies or ACLs control exactly which services can cross boundaries. That lets guest traffic stay internet-only, staff reach approved internal apps, and medical devices communicate only with the monitoring server.
Clue confirmation
The clue words "best", "least", "never" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Use a single wireless SSID with client isolation enabled and NAT all traffic through one gateway.
Why it's wrong here
Client isolation limits peer-to-peer access on the same wireless segment, but it does not create strong separation between guest, staff, and medical systems. NAT also does not provide the granular policy control needed to restrict medical-device communications.
✗
Deploy network access control only at login time and allow all devices onto the same internal subnet afterward.
Why it's wrong here
NAC can help with admission control, but if all devices share the same subnet afterward, they remain able to communicate more broadly than intended. That weakens segmentation and makes policy enforcement much harder.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates may choose client isolation (Option C) thinking it provides security, but it breaks required device-to-server communication and does not enforce role-based access, whereas VLANs with firewall policies offer precise, scalable segmentation.

Detailed technical explanation

How to think about this question

VLANs operate at Layer 2 using 802.1Q tagging to separate traffic, while firewall policies (e.g., using iptables or a next-gen firewall) apply Layer 3/4 rules to permit or deny inter-VLAN traffic. In this scenario, a router-on-a-stick or Layer 3 switch with ACLs can enforce that the medical VLAN (e.g., VLAN 30) only allows traffic to the monitoring server’s IP and port, while blocking all other inter-VLAN traffic. Real-world hospital networks often use separate SSIDs mapped to VLANs (e.g., guest on VLAN 10, staff on VLAN 20, medical on VLAN 30) with firewall rules to meet HIPAA compliance.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Security exam questions test whether you can match controls to threats in context — not just recall definitions.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related SY0-701 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

General Security Concepts practice questions

Practise SY0-701 questions linked to General Security Concepts.

Threats, Vulnerabilities, and Mitigations practice questions

Practise SY0-701 questions linked to Threats, Vulnerabilities, and Mitigations.

Security Architecture practice questions

Practise SY0-701 questions linked to Security Architecture.

Security Operations practice questions

Practise SY0-701 questions linked to Security Operations.

Security Program Management and Oversight practice questions

Practise SY0-701 questions linked to Security Program Management and Oversight.

Security+ social engineering questions

Practise SY0-701 questions linked to Security+ social engineering questions.

Security+ cryptography practice questions

Practise SY0-701 questions linked to Security+ cryptography.

Security+ IAM questions

Practise SY0-701 questions linked to Security+ IAM questions.

Security+ risk management questions

Practise SY0-701 questions linked to Security+ risk management questions.

Security+ incident response questions

Practise SY0-701 questions linked to Security+ incident response questions.

Security+ malware questions

Practise SY0-701 questions linked to Security+ malware questions.

Security+ vulnerability management questions

Practise SY0-701 questions linked to Security+ vulnerability management questions.

Practice this exam

Start a free SY0-701 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

SY0-701 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this SY0-701 question test?

Security Architecture — This question tests Security Architecture — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Create separate VLANs for guest, staff, and medical devices, then enforce traffic rules between them with firewall policies. — Option B is correct because VLANs logically segment the network into isolated broadcast domains for guest, staff, and medical devices, while firewall policies (e.g., using ACLs or stateful inspection) enforce granular traffic rules. This design ensures medical devices can only communicate with the monitoring server, guests are restricted to internet-only access, and staff can reach internal applications, all without requiring complex physical reconfiguration.

What should I do if I get this SY0-701 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "best", "least", "never". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.