SY0-701 Security Architecture Practice Question
A security architect at a retail company is deploying a new e-commerce platform that processes credit card payments. The architect needs to minimize the scope of the PCI DSS assessment. The platform consists of a web server, an application server, and a database server. The cardholder data (credit card numbers) will be processed and stored only on the database server. Which of the following network architecture designs would best reduce the PCI DSS scope?
⚠ Common exam trap
Watch out — candidates often confuse security controls (encryption, IDS) with architectural segmentation, mistakenly believing that encryption or monitoring alone can reduce PCI DSS scope, when only network isolation with a firewall boundary achieves that.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the database server in a separate, isolated network segment with a dedicated firewall that blocks all traffic except from the application server on the required port.
Isolating the database server in a separate network segment with a dedicated firewall that restricts traffic to only the application server on the required port creates a clear network segmentation boundary. This segmentation limits the cardholder data environment (CDE) to just the database server, thereby minimizing the scope of the PCI DSS assessment by excluding the web and application servers from the CDE.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place all servers in the same VLAN and apply a host-based firewall on the database server.
Why it's wrong here
Placing all servers in the same VLAN creates a flat network where any server can potentially communicate with the database server. This would include the web and application servers in the PCI DSS scope because they are on the same network segment and can directly connect to cardholder data, increasing the assessment scope.
When this WOULD be correct
In a scenario where the question asks for a cost-effective security control to protect a single critical server within a flat network, and the primary concern is limiting lateral movement from compromised peers, placing all servers in the same VLAN with a host-based firewall on the critical server could be a valid answer.
- ✓
Place the database server in a separate, isolated network segment with a dedicated firewall that blocks all traffic except from the application server on the required port.
Why this is correct
This design creates a clear cardholder data environment (CDE) boundary. The dedicated firewall restricts access so only the application server can communicate with the database server on a specific port. The web server and application server can be placed outside the CDE if they do not directly transmit or store cardholder data, thereby reducing the PCI DSS scope.
- ✗
Encrypt all data in transit using TLS and at rest using AES-256.
Why it's wrong here
Encryption is a mandatory PCI DSS requirement for protecting cardholder data, but it does not reduce the scope of the assessment. The systems that handle encrypted data are still in scope because they process and store the data, even if encrypted. Scope reduction requires network segmentation, not encryption alone.
When this WOULD be correct
A question asking how to protect cardholder data in transit and at rest to meet PCI DSS encryption requirements, without regard to reducing assessment scope.
- ✗
Implement network intrusion detection systems on all network segments.
Why it's wrong here
Intrusion detection systems are detective controls and do not change which systems are in scope for PCI DSS. They can help with security monitoring but do not provide the architectural isolation needed to reduce the cardholder data environment.
When this WOULD be correct
A question asking for a security control to detect and alert on potential attacks against cardholder data environments, where the goal is to improve monitoring and incident response capabilities, not to reduce PCI DSS scope.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Place the database server in a separate, isolated network segment with a dedicated firewall that blocks all traffic except from the application server on the required port.Correct answer▾
Why this is correct
This design creates a clear cardholder data environment (CDE) boundary. The dedicated firewall restricts access so only the application server can communicate with the database server on a specific port. The web server and application server can be placed outside the CDE if they do not directly transmit or store cardholder data, thereby reducing the PCI DSS scope.
✗Place all servers in the same VLAN and apply a host-based firewall on the database server.Wrong answer — click to see why▾
Why this is wrong here
Placing all servers in the same VLAN does not isolate the database server, so the entire network segment is in scope for PCI DSS. A host-based firewall on the database server alone does not reduce the network segmentation required to minimize scope.
★ When this WOULD be the correct answer
In a scenario where the question asks for a cost-effective security control to protect a single critical server within a flat network, and the primary concern is limiting lateral movement from compromised peers, placing all servers in the same VLAN with a host-based firewall on the critical server could be a valid answer.
Why candidates choose this
Candidates may think that a host-based firewall provides sufficient isolation, not realizing that PCI DSS requires network segmentation (e.g., separate subnet with a firewall) to reduce scope, not just host-level controls.
✗Encrypt all data in transit using TLS and at rest using AES-256.Wrong answer — click to see why▾
Why this is wrong here
Encryption protects data confidentiality but does not isolate the database server from the rest of the network; PCI DSS scope is determined by network segmentation, not encryption. Without segmentation, all servers are in scope.
★ When this WOULD be the correct answer
A question asking how to protect cardholder data in transit and at rest to meet PCI DSS encryption requirements, without regard to reducing assessment scope.
Why candidates choose this
Candidates often confuse security controls (encryption) with scope reduction, believing that encrypting data eliminates the need for network segmentation.
✗Implement network intrusion detection systems on all network segments.Wrong answer — click to see why▾
Why this is wrong here
Implementing network intrusion detection systems (NIDS) does not reduce the scope of PCI DSS assessment because scope is determined by the systems that store, process, or transmit cardholder data, not by security controls like NIDS.
★ When this WOULD be the correct answer
A question asking for a security control to detect and alert on potential attacks against cardholder data environments, where the goal is to improve monitoring and incident response capabilities, not to reduce PCI DSS scope.
Why candidates choose this
Candidates may think that adding security controls like NIDS automatically reduces compliance scope, but PCI DSS scope is about network segmentation and data flow, not just security tools.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.