SY0-701 Security Architecture Practice Question
A security architect is designing the wireless network for a new branch office. The branch will have two types of users: employees who need access to internal corporate resources, and guests who need internet-only access. The architect plans to use WPA3-Enterprise for the employee SSID and WPA3-SAE for the guest SSID. Which of the following additional configurations is MOST critical to prevent guests from accessing internal corporate resources?
⚠ Common exam trap
The trap here is that candidates focus on wireless security protocols (WPA3-SAE vs. Enterprise) or SSID hiding, but the exam tests the understanding that network segmentation and firewall rules are the critical controls for preventing unauthorized access between different trust zones, regardless of the wireless encryption method used.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the guest wireless network on a separate VLAN with a firewall rule blocking inbound traffic to the corporate VLAN.
The most critical configuration is to isolate the guest network from the corporate network. Placing the guest SSID on a separate VLAN and implementing a firewall rule that blocks inbound traffic from the guest VLAN to the corporate VLAN ensures that even if a guest device is compromised or malicious, it cannot initiate connections to internal corporate resources. This leverages network segmentation and access control lists (ACLs) to enforce the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement MAC address filtering on the guest SSID to allow only authorized guest devices.
Why it's wrong here
MAC address filtering is a trivial Layer 2 control that can be bypassed by an attacker who passively sniffs the airwaves to discover an allowed MAC address and then clones it on their own wireless adapter. It also fails to provide any Layer 3 isolation: if an authorized guest device is exploited or simply misconfigured to route traffic to the corporate VLAN, the MAC filter does nothing to stop that traffic. Moreover, managing a dynamic list of guest MAC addresses is operationally impractical and does not scale, and it does not address threats such as rogue devices or guest clients that are already on the network.
When this WOULD be correct
A question asks for the best method to prevent unauthorized devices from connecting to a guest network, where the primary concern is device authentication rather than network segmentation. For example, a small office with a flat network where guest and employee traffic are not separated.
- ✓
Place the guest wireless network on a separate VLAN with a firewall rule blocking inbound traffic to the corporate VLAN.
Why this is correct
This is the most critical control because it enforces network segmentation at Layer 3: the guest VLAN has its own IP subnet and routing context, and the firewall rule explicitly denies any inbound traffic from the guest VLAN to the corporate VLAN. This prevents a guest device from directly reaching internal resources even if the wireless password is shared or compromised, because all inter-VLAN traffic must traverse the firewall, where the policy is enforced. Additionally, the guest VLAN can be configured with a default route only to the internet, typically via NAT, so guests get connectivity while the corporate network remains logically invisible and unreachable from the guest segment.
- ✗
Disable SSID broadcast for the guest network to make it less discoverable.
Why it's wrong here
Disabling SSID broadcast is a weak security measure that only hides the network name from basic scans. It does not prevent attackers from discovering the network using more advanced tools, and it provides no isolation from the corporate network.
When this WOULD be correct
In a scenario where the goal is to reduce the visibility of a sensitive network to casual users or to comply with a policy that requires non-broadcast SSIDs for certain networks, disabling SSID broadcast would be the correct choice.
- ✗
Require guests to accept a captive portal agreement before gaining internet access.
Why it's wrong here
A captive portal only forces the guest to acknowledge an acceptable-use policy or authenticate before gaining internet access; it is a Layer 7 control that does not establish any network-level separation. Without a VLAN and firewall rule, a guest device that passes the portal still resides on the same broadcast domain or routed segment as the corporate network and can potentially reach internal servers if the default gateway is not restricted. In many misconfigured deployments, the portal merely intercepts HTTP traffic for a moment, and the client's IP address remains in the same subnet, allowing direct access to corporate resources once the portal is dismissed.
When this WOULD be correct
In a scenario where the question asks for the best method to enforce acceptable use policy or obtain legal consent for internet access, such as in a hotel or public Wi-Fi, requiring a captive portal agreement would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Place the guest wireless network on a separate VLAN with a firewall rule blocking inbound traffic to the corporate VLAN.Correct answer▾
Why this is correct
This is the most critical control because it enforces network segmentation at Layer 3: the guest VLAN has its own IP subnet and routing context, and the firewall rule explicitly denies any inbound traffic from the guest VLAN to the corporate VLAN. This prevents a guest device from directly reaching internal resources even if the wireless password is shared or compromised, because all inter-VLAN traffic must traverse the firewall, where the policy is enforced. Additionally, the guest VLAN can be configured with a default route only to the internet, typically via NAT, so guests get connectivity while the corporate network remains logically invisible and unreachable from the guest segment.
✗Implement MAC address filtering on the guest SSID to allow only authorized guest devices.Wrong answer — click to see why▾
Why this is wrong here
MAC address filtering does not prevent guests from accessing internal resources; it only controls which devices can connect to the guest SSID. Once connected, guests could still reach corporate resources if network segmentation is not enforced.
★ When this WOULD be the correct answer
A question asks for the best method to prevent unauthorized devices from connecting to a guest network, where the primary concern is device authentication rather than network segmentation. For example, a small office with a flat network where guest and employee traffic are not separated.
Why candidates choose this
Candidates may think MAC filtering provides strong access control, but they overlook that it does not address network-layer isolation between guest and corporate networks.
✗Disable SSID broadcast for the guest network to make it less discoverable.Wrong answer — click to see why▾
Why this is wrong here
Disabling SSID broadcast does not prevent guests from accessing internal resources; it only hides the network name from passive scans, which is a weak security measure easily bypassed.
★ When this WOULD be the correct answer
In a scenario where the goal is to reduce the visibility of a sensitive network to casual users or to comply with a policy that requires non-broadcast SSIDs for certain networks, disabling SSID broadcast would be the correct choice.
Why candidates choose this
Candidates may think that hiding the SSID adds a layer of security by making the network less discoverable, confusing obscurity with access control.
✗Require guests to accept a captive portal agreement before gaining internet access.Wrong answer — click to see why▾
Why this is wrong here
A captive portal agreement only provides legal consent and does not enforce network segmentation; guests could still access corporate resources if they are on the same VLAN or subnet.
★ When this WOULD be the correct answer
In a scenario where the question asks for the best method to enforce acceptable use policy or obtain legal consent for internet access, such as in a hotel or public Wi-Fi, requiring a captive portal agreement would be correct.
Why candidates choose this
Candidates may mistakenly believe that a captive portal provides security by restricting access, but it only controls initial access and does not prevent lateral movement within the network.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
VLAN
A VLAN (Virtual Local Area Network) is a logical grouping of network devices that behave as if they are on the same physical network segment, regardless of their actual physical location.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.