A small enterprise is rebuilding its public customer portal. The web front end must be reachable from the internet, the application tier should never be directly exposed, and the database must remain private even if the web server is compromised. Which two design changes best meet those goals? Select two.

Put the database on the same subnet as the web front end so internal calls have lower latency.

Putting the database on the same subnet increases blast radius and exposes sensitive data to a broader set of compromises. Lower latency is not a security justification when the design goal is isolation. The database should remain in a separate internal zone with tightly controlled access, not share the same network segment as the public-facing server.

Allow the database to accept connections from the internet if strong passwords are used.

Direct internet exposure of a database is a poor design choice even when passwords are strong. Passwords alone do not prevent scanning, exploit attempts, or credential stuffing against the service. The database should be isolated behind internal controls and reachable only from approved application components, not from external networks.

Disable all inbound filtering on the DMZ so troubleshooting is simpler.

Removing inbound filtering defeats the purpose of a DMZ and greatly increases risk. Troubleshooting convenience is not a valid reason to expose services broadly. A secure design keeps only the necessary ports open and uses logging, documentation, and controlled rules to support administration without weakening security boundaries.

What does this SY0-701 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Place the web front end in a DMZ behind a firewall rule allowing only HTTPS from the internet. — The best choices are A and C. The web front end belongs in a DMZ because it is the only tier that should face the internet, and firewall rules should restrict exposure to the minimum needed service. The application tier should stay on an internal subnet and accept traffic only from the web layer. Together, these controls reduce attack surface and prevent a compromise of one tier from immediately exposing the database or internal services. Why others are wrong: B weakens segmentation by placing sensitive data too close to the exposed tier. D relies on passwords alone and leaves the database directly reachable from the internet, which is unacceptable. E removes the filtering that makes the DMZ useful in the first place and would create unnecessary risk rather than reducing it.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.