SY0-701 Security Architecture Practice Question
A small company is moving its public web app to a new network. The front-end server must be reachable from the internet, the application server should only accept traffic from the front end, and the database must never be reachable from the internet or user VLANs. Which design best meets these requirements with the least exposure?
⚠ Common exam trap
A common mix-up: candidates think host-based firewalls are sufficient for isolation (Option A) or that placing the database in the DMZ simplifies access (Option C), but the exam expects you to recognize that network segmentation with separate subnets and firewall rules is the most secure and least exposure approach for multi-tier applications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the web server in a DMZ, the application server in an internal subnet, and the database in a separate restricted subnet with firewall rules between each tier.
It implements a classic three-tier architecture with network segmentation. The web server in the DMZ is isolated from internal networks but accessible from the internet, the application server in an internal subnet is protected by firewall rules that only allow traffic from the DMZ, and the database in a separate restricted subnet is further isolated with firewall rules that only permit traffic from the application server. This design minimizes exposure by enforcing least privilege and defense in depth, using network-layer segmentation rather than relying solely on host-based controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place all three servers in the same server VLAN and use host-based firewalls to separate them.
Why it's wrong here
Putting all three tiers in one server VLAN preserves a single flat L2 segment, so any host that is compromised can freely ARP-scan and reach the others without crossing a filtering device. Host-based firewalls are useful but rely on per-host policy and local configuration, which can be inconsistent, disabled by an attacker, or bypassed through local privilege escalation. This design lacks the mandatory network-level isolation that a DMZ or restricted subnets provide.
- ✓
Place the web server in a DMZ, the application server in an internal subnet, and the database in a separate restricted subnet with firewall rules between each tier.
Why this is correct
This is the strongest design because each tier is isolated according to exposure. The web server is the only internet-facing system, the application tier only receives approved traffic from the web tier, and the database is protected behind internal filtering. That layout limits attack paths and supports least privilege between network zones.
- ✗
Place the database in the DMZ so the web and application servers can access it directly without extra firewall rules.
Why it's wrong here
Placing the database directly in the DMZ puts the organization's most sensitive asset on the same segment that the public web server must expose to the internet. If the web application is exploited, an attacker already has network access to the database and can query it without traversing an internal firewall rule, defeating the purpose of layered security. A database should be behind two layers of filtering in a dedicated restricted subnet so that a compromise of the perimeter tier does not immediately yield data.
- ✗
Place the web server on the user VLAN and use NAT to hide the database server from the internet.
Why it's wrong here
Installing the web server in the user VLAN mixes a publicly reachable service with end-user workstations, so a successful attack against the web server gives the attacker a foothold inside normal client traffic and access to internal resources. NAT only rewrites addresses and does not filter or block sessions, so it provides no actual security; the database remains reachable internally from any host permitted by routing. Proper design places the web server in a DMZ and the database in a separate restricted subnet with explicit firewall allow rules.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.