SY0-701 Security Architecture Practice Question
A small company is redesigning its network for a public web application. The web front end must be reachable from the internet, but the database should never be exposed directly to external or general user traffic. Which architecture is the best choice?
⚠ Common exam trap
Test-takers frequently think host firewalls are sufficient for internal subnet isolation (Option A) or mistakenly believe placing the database in the DMZ simplifies routing (Option C), overlooking the fundamental security principle of defense in depth and the need to keep sensitive data stores off the internet-facing network.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the web server in a DMZ and keep the database in a private internal subnet with only required application traffic allowed.
It implements a layered security architecture: the web server resides in a DMZ (demilitarized zone) where it is reachable from the internet, while the database is placed in a private internal subnet with strict firewall rules that only allow the required application traffic (e.g., TCP port 3306 for MySQL or 1433 for MSSQL) from the web server. This ensures the database is never directly exposed to external or general user traffic, reducing the attack surface and preventing direct internet-based attacks on the database.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place both the web server and database in the same internal subnet and rely on host firewalls.
Why it's wrong here
Placing both systems in the same internal subnet creates a flat network where the database is reachable from any host in that segment, not just the web server. Host firewalls are only as reliable as their configuration, and a compromised web server gives an attacker direct lateral access to the database without traversing any network security boundary. This design increases blast radius and violates the principle of least privilege, since the database should only accept traffic from the web tier over specific ports.
- ✓
Place the web server in a DMZ and keep the database in a private internal subnet with only required application traffic allowed.
Why this is correct
This separates the internet-facing system from the sensitive backend. The DMZ limits exposure of the web server, while the database remains inaccessible from external networks and is reachable only over tightly filtered application ports from the web tier.
- ✗
Place the database in the DMZ so the web server can query it directly without internal routing.
Why it's wrong here
A DMZ is a semi-trusted buffer zone that is intentionally accessible from the internet; placing a database there means the database is one step away from direct external exposure. Once the web server is compromised, an attacker can pivot laterally within the DMZ to the database without needing to cross the internal firewall, and any firewall misconfiguration could expose the database to the internet. The database should reside in a private subnet with no internet route, reachable only through tightly controlled firewall rules from the web tier.
- ✗
Keep both systems public but restrict access with NAT and strong administrator passwords.
Why it's wrong here
Network Address Translation (NAT) merely maps public IPs to private ones; it does not inspect or filter traffic and therefore provides no meaningful security boundary. Strong administrator passwords are an authentication control, but they cannot protect the database from application-layer attacks, unpatched vulnerabilities, or direct TCP/IP exposure from the internet. Making the database publicly reachable essentially hands attackers a direct attack plane, and no password policy or NAT rule can compensate for the lack of network segmentation.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.