SY0-701 Security Architecture Practice Question
A hospital is redesigning its wireless network. Guest devices must reach only the internet. Staff laptops need access to internal applications. Medical devices must communicate with a monitoring server but never with guest devices or the broader employee LAN. What design best meets these goals with the least operational complexity?
⚠ Common exam trap
Watch out — candidates often choose client isolation (Option C) thinking it provides security, but it breaks required device-to-server communication and does not enforce role-based access, whereas VLANs with firewall policies offer precise, scalable segmentation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create separate VLANs for guest, staff, and medical devices, then enforce traffic rules between them with firewall policies.
VLANs logically segment the network into isolated broadcast domains for guest, staff, and medical devices, while firewall policies (e.g., using ACLs or stateful inspection) enforce granular traffic rules. This design ensures medical devices can only communicate with the monitoring server, guests are restricted to internet-only access, and staff can reach internal applications, all without requiring complex physical reconfiguration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place all devices on one flat network and rely on endpoint antivirus for protection.
Why it's wrong here
A single flat network lacks VLAN segmentation or firewall rules, so medical devices would share a broadcast domain with guest and staff traffic, violating the requirement that they never communicate with guest devices or the employee LAN. This design is tempting because it minimises configuration overhead and is often used in small offices where all endpoints are trusted and no isolation is needed.
- ✓
Create separate VLANs for guest, staff, and medical devices, then enforce traffic rules between them with firewall policies.
Why this is correct
This approach provides clean segmentation while keeping administration manageable. Separate VLANs define distinct trust zones, and firewall policies or ACLs control exactly which services can cross boundaries. That lets guest traffic stay internet-only, staff reach approved internal apps, and medical devices communicate only with the monitoring server.
- ✗
Use a single wireless SSID with client isolation enabled and NAT all traffic through one gateway.
Why it's wrong here
Client isolation limits peer-to-peer access on the same wireless segment, but it does not create strong separation between guest, staff, and medical systems. NAT also does not provide the granular policy control needed to restrict medical-device communications.
- ✗
Deploy network access control only at login time and allow all devices onto the same internal subnet afterward.
Why it's wrong here
Network Access Control (NAC) that only checks credentials at login is a form of admission control, but it does not enforce ongoing traffic isolation. Once a device is admitted, it shares the same Layer 2 broadcast domain and IP subnet as all other systems, allowing guest, staff, and medical devices to communicate directly with little to no restriction. This 'check once, trust always' model fails the security requirement to keep medical devices from ever talking to guest endpoints, because there are no firewall rules or VLAN boundaries to filter east-west traffic afterward.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Segment
A segment is a division of a larger network, such as a collision domain, broadcast domain, or a portion of a TCP data stream, used to organize traffic and improve performance.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.