SY0-701 Security Architecture Practice Question
A small company is deploying a public web application with a front-end server, an API server, and a database. The web server must be reachable from the internet, the API must be reachable only from the web server, and the database must never be accessible from user subnets. Which design best meets the requirement?
⚠ Common exam trap
A common mix-up: candidates think placing the database in the DMZ simplifies connectivity, but they overlook that the DMZ is inherently less secure and directly violates the requirement that the database must never be accessible from user subnets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the web server in a DMZ, the API server in an internal subnet, and the database in a separate restricted subnet.
It implements a layered security architecture: the web server resides in a DMZ (demilitarized zone) to be publicly accessible, the API server is placed in an internal subnet with firewall rules allowing only traffic from the web server, and the database is isolated in a restricted subnet with no access from user subnets. This design enforces the principle of least privilege and prevents direct internet exposure of the API and database, which is critical for protecting sensitive data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place all three servers on the same internal VLAN and use host firewalls only.
Why it's wrong here
This flat network design places all tiers in a single broadcast domain, eliminating the isolation needed to contain a breach. Host firewalls are software-based and can be disabled by a successful attacker or misconfigured, offering no protection once an application is exploited. Without separate subnets and enforced filtering rules, an attacker who compromises the web server can move laterally to the database with ease, making this a poor security architecture.
- ✓
Place the web server in a DMZ, the API server in an internal subnet, and the database in a separate restricted subnet.
Why this is correct
This architecture implements defense-in-depth by separating workloads into distinct trust zones: the web server sits in a demilitarized zone (DMZ) exposed to the internet, the API resides in an internal subnet, and the database is isolated in a restricted subnet with allow-list rules. The web server is the only component with direct internet exposure, while the API and database remain inaccessible from outside, and strict firewall policies govern east-west traffic between tiers. This containment limits the blast radius of a compromise, as an attacker who breaches the web server must still traverse multiple security controls to reach sensitive data.
- ✗
Place the database in the DMZ so the web server can connect to it with fewer firewall rules.
Why it's wrong here
Placing the database in the DMZ directly exposes the most sensitive component to the internet-facing network, greatly expanding its attack surface. The DMZ is intended only for services that must be publicly reachable, and a database normally has no need to accept traffic from the internet. This configuration makes the database reachable via compromised web services and reduces firewall filtering, increasing the risk of unauthorized access and data exfiltration.
- ✗
Use a single NAT gateway for all servers and rely on public IP filtering at the edge.
Why it's wrong here
Network address translation (NAT) is not a security control; it performs address translation and provides no isolation between servers. Relying solely on public IP filtering at the edge inspects only external traffic, leaving all internal lateral movement unmonitored and unrestricted. If an attacker compromises any one server, they can pivot unhindered to the other tiers, because there is no internal segmentation or host-based enforcement. This single-layer defense violates the principle of defense-in-depth and fails to protect the application's internal communications.
Visual reference
Go deeper
Related to this question
Learn chapter
Firewall Types and Deployment
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.