SY0-701 Security Architecture Practice Question
A security architect is designing a new data center network that will host public-facing web servers and internal application servers handling confidential employee data. The architect places the web servers in a DMZ and the internal application servers on a separate internal network segment. A stateful firewall is configured to allow inbound HTTP/HTTPS traffic from the internet to the web servers only. The firewall also permits only the web servers to initiate outbound connections to the internal application servers on a specific TCP port, and all such traffic is encrypted using TLS. Which security architecture principle is this design primarily intended to enforce?
⚠ Common exam trap
Many exam-takers confuse 'defense in depth' with 'least privilege' because both involve restricting access, but defense in depth specifically refers to multiple overlapping security layers (network segmentation, firewalls, encryption) rather than minimal permissions for a single component.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Defense in depth
The design enforces defense in depth by layering multiple security controls: a DMZ isolates public-facing web servers from internal networks, a stateful firewall restricts inbound traffic to HTTP/HTTPS only, and outbound connections from web servers to internal application servers are limited to a specific TCP port with TLS encryption. This layered approach ensures that even if one control fails (e.g., a web server is compromised), the attacker still faces additional barriers to reach sensitive internal systems.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Least privilege
Why it's wrong here
This option is incorrect because least privilege is a principle that limits users, devices, or processes to only the minimum access needed to perform their functions. While the firewall does restrict traffic to specific ports and sources, that is a single instance of access restriction within a broader architecture that also includes network segmentation and encryption. The design's primary intent is to create multiple overlapping layers of defense so that failure of any one control does not compromise the system, which is defense in depth, not least privilege itself.
When this WOULD be correct
A question that asks: 'A security policy states that web servers should only be able to communicate with database servers on TCP port 3306 and no other traffic. Which principle is being applied?' Here, the focus is solely on restricting permissions to the minimum necessary, making least privilege the correct answer.
- ✓
Defense in depth
Why this is correct
Correct. The design uses network segmentation, firewalls, and encryption to create multiple layers of defense. This is the core concept of defense in depth, ensuring that a failure in one layer does not compromise the entire system.
- ✗
Separation of duties
Why it's wrong here
This option is incorrect because separation of duties is a governance principle that splits privileged administrative functions among different individuals or roles to reduce insider threats and fraud; it governs human processes, not network architecture. Firewall rules, segmentation, and encryption are technical controls that operate independently of user roles. The scenario describes layered technical safeguards, not a division of administrative responsibilities, so it does not match the design concept.
When this WOULD be correct
In a scenario where different administrators are responsible for managing web servers versus internal application servers, and policies ensure that no single person has access to both environments, separation of duties would be the correct principle.
- ✗
Zero trust
Why it's wrong here
Zero trust requires that no entity is inherently trusted and that every access request must be authenticated and authorized. In this design, the web servers are implicitly trusted to initiate connections to the internal servers once the firewall rule is in place, which does not fully align with zero trust principles.
When this WOULD be correct
A question describing a network architecture where no implicit trust is granted based on network location, every access request is authenticated and authorized regardless of source (e.g., all traffic between internal servers must be authenticated and encrypted, with micro-segmentation enforced).
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Defense in depthCorrect answer▾
Why this is correct
Correct. The design uses network segmentation, firewalls, and encryption to create multiple layers of defense. This is the core concept of defense in depth, ensuring that a failure in one layer does not compromise the entire system.
✗Least privilegeWrong answer — click to see why▾
Why this is wrong here
The design restricts web servers to only initiate outbound connections to internal servers on a specific port, which is an example of least privilege, but the question asks for the primary principle. The overall architecture with multiple layers (DMZ, separate network, firewall rules, TLS) is defense in depth, not just least privilege.
★ When this WOULD be the correct answer
A question that asks: 'A security policy states that web servers should only be able to communicate with database servers on TCP port 3306 and no other traffic. Which principle is being applied?' Here, the focus is solely on restricting permissions to the minimum necessary, making least privilege the correct answer.
Why candidates choose this
Candidates see the firewall rule that permits only specific outbound connections and mistakenly think that is the core principle, overlooking that the question emphasizes the layered security approach (DMZ, segmentation, encryption) which is defense in depth.
✗Separation of dutiesWrong answer — click to see why▾
Why this is wrong here
The design does not separate duties among different people or roles; it separates network segments and controls traffic, which is about defense in depth, not separation of duties.
★ When this WOULD be the correct answer
In a scenario where different administrators are responsible for managing web servers versus internal application servers, and policies ensure that no single person has access to both environments, separation of duties would be the correct principle.
Why candidates choose this
Candidates may confuse 'separation of duties' with 'network segmentation' because both involve dividing resources, but separation of duties specifically refers to dividing responsibilities among people to prevent fraud or error.
✗Zero trustWrong answer — click to see why▾
Why this is wrong here
The design explicitly uses multiple layers of security (DMZ, separate internal segment, stateful firewall, TLS encryption), which is defense in depth, not zero trust. Zero trust would require continuous verification of every request regardless of network location, which is not described.
★ When this WOULD be the correct answer
A question describing a network architecture where no implicit trust is granted based on network location, every access request is authenticated and authorized regardless of source (e.g., all traffic between internal servers must be authenticated and encrypted, with micro-segmentation enforced).
Why candidates choose this
Candidates may mistakenly think that restricting traffic between segments and requiring encryption aligns with zero trust, but zero trust is a broader model that includes continuous verification and least privilege, not just network segmentation.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
TCP
TCP (Transmission Control Protocol) is a core internet protocol that ensures data is sent reliably and in order between devices over a network.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.