SY0-701 Security Architecture Practice Question
A router interface connects the DMZ subnet 10.10.10.0/24 to the internal network. A web server at 10.10.10.25 must reach an application server at 10.10.20.20 on TCP 8443, and all other DMZ-to-internal traffic must be blocked. Which two ACL entries should be applied inbound on the DMZ-facing interface? Select two.
⚠ Common exam trap
The SY0-701 exam often tests the misconception that a single permit statement is sufficient, but candidates forget that an explicit deny entry is needed to block all other traffic when the requirement specifies 'all other traffic must be blocked', as the implicit deny alone does not satisfy the explicit blocking requirement in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
permit tcp 10.10.10.25 host 10.10.20.20 eq 8443
It permits TCP traffic from the specific web server (10.10.10.25) to the application server (10.10.20.20) on destination port 8443, which is the only allowed DMZ-to-internal communication. This entry uses the 'host' keyword to specify the exact source IP and the 'eq' keyword to match the required destination port, implementing the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
permit tcp 10.10.10.25 host 10.10.20.20 eq 8443
Why this is correct
This rule allows only the required web-server-to-application-server connection on the specified port. It uses a very narrow source and destination definition, which is the safest way to permit the business flow. The ACL should allow the needed application traffic and nothing broader than that.
- ✗
permit tcp host 10.10.20.20 any eq 8443
Why it's wrong here
This rule is written in the wrong direction and is far too broad. It permits traffic sourced from the application server to any destination, which does not match the required flow. ACLs must be precise about source, destination, and direction.
- ✓
deny ip 10.10.10.0/24 10.10.20.0/24
Why this is correct
This rule blocks all remaining DMZ-originated traffic toward the internal subnet after the specific permit has been evaluated. That matches the stated requirement to stop any other DMZ-to-internal communication. Using a deny rule after the allowed exception is a standard way to enforce default deny.
- ✗
permit ip any any
Why it's wrong here
This would allow all traffic through the interface and completely defeat the purpose of the segmentation boundary. A rule like this is useful only when the goal is unrestricted access, which is the opposite of the scenario. Default deny should remain in place for all other flows.
- ✗
permit udp 10.10.10.0/24 host 10.10.20.20 eq 8443
Why it's wrong here
The application requires TCP, not UDP, so this rule would not allow the intended service to function. It also uses a broad subnet rather than the specific web host. Protocol and addressing must match the actual application flow.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Access Control List
An Access Control List is a set of rules that decides which traffic is allowed or denied entry to a network or device.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.