SY0-701 Security Architecture Practice Question
A small company is publishing an internal website to the internet. The security team wants the web server reachable from the internet while keeping the database and file share isolated from direct internet access. Which design is best?
⚠ Common exam trap
Many candidates confuse a DMZ as a place to put all servers that need internet access, but the correct design isolates only the front-end web server in the DMZ while keeping backend services like databases and file shares on a separate internal subnet to prevent direct exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the web server in a DMZ and keep the database and file share on a private internal subnet.
It implements a DMZ architecture where the web server is placed in a publicly accessible network segment, while the database and file share reside on a private internal subnet. This design ensures that even if the web server is compromised, an attacker cannot directly access the internal resources because firewall rules restrict inbound traffic to only the DMZ and block any initiated connections from the DMZ to the internal network. This follows the principle of defense in depth and network segmentation as recommended by CompTIA for securing multi-tier applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place the web server and database on the same flat internal network behind the firewall.
Why it's wrong here
Placing the web server and database on the same flat internal network behind the firewall treats the entire internal segment as a single trust zone. If the publicly exposed web server is compromised, an attacker can immediately pivot to the database and file shares with no additional network boundaries to cross. This design lacks east-west segmentation and fails to isolate sensitive back-end systems from the internet-facing web tier, increasing the blast radius of any single server compromise.
- ✓
Place the web server in a DMZ and keep the database and file share on a private internal subnet.
Why this is correct
This is the best design because the internet-facing system is isolated in a DMZ, while sensitive back-end systems stay off the public path. Traffic can be tightly filtered so only the required web-to-database communication is allowed. That reduces exposure if the web server is compromised.
- ✗
Place the database in the DMZ and keep the web server on the internal user VLAN.
Why it's wrong here
Placing the database in the DMZ exposes it directly to the internet, violating the requirement for database isolation. Simultaneously, keeping the web server on the internal user VLAN prevents it from being reachable from the internet, failing the primary objective. This design might be tempting as it correctly utilises a DMZ for internet-facing components, but misapplies it by exposing the sensitive database and isolating the public web server.
- ✗
Use a VPN for all users and keep every server on the same subnet.
Why it's wrong here
A VPN only secures remote user connections; it does not create isolation between the public-facing web server and the internal database if they share the same subnet. Because the web server is still directly reachable from the internet, an attacker can bypass the VPN entirely and target the internal subnet, and any lateral movement from the web server to the database would be completely unfiltered. This approach confuses remote-access security with network segmentation, leaving the sensitive back-end systems exposed to the same network path as public traffic.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
DMZ
A DMZ (demilitarized zone) is a network segment that sits between an internal private network and the public internet, hosting publicly accessible services while keeping the internal network isolated.
Key term
Defense in depth
Defense in depth is a cybersecurity strategy that uses multiple layers of security controls to protect information and systems, so if one layer fails, another layer is already in place to stop the attack.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.