SY0-701 Security Architecture Practice Question
A web application must be reachable from the internet, but its database should be isolated from direct internet access. Which two placements or controls are most appropriate? Select two.
⚠ Common exam trap
A common mix-up: candidates think placing both systems in the DMZ is acceptable, but they overlook that the database must be on an internal segment with strict access controls, not just any segment with internet exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the web server in a DMZ.
Placing the web server in a DMZ (Option A) allows it to be reachable from the internet while the internal firewall restricts inbound traffic to only necessary ports (e.g., TCP 80/443). Keeping the database on an internal network segment (Option B) and configuring firewall rules to allow traffic only from the web server’s IP address ensures the database is isolated from direct internet access, preventing external attacks on the database service.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Place the web server in a DMZ.
Why this is correct
A DMZ is a separate network segment that sits between the internet and the internal LAN. It is designed to host public-facing services like web servers, with firewall rules that allow inbound traffic only to the web server, while preventing direct access to internal resources. This containment limits compromise impact.
- ✓
Keep the database on an internal network segment and restrict access to the web server only.
Why this is correct
Isolating the database on an internal network segment with strict ACLs ensures it is not directly reachable from the internet. Only the web server's IP or service account can connect to the database on specific ports, reducing the attack surface and protecting sensitive data through defense in depth.
- ✗
Place both the web server and the database on the same internet-facing subnet.
Why it's wrong here
Placing both web and database on the same internet-facing subnet means the database is exposed to any attacker who compromises the web server or directly scans the subnet, bypassing the need to pivot through the web tier. This conflates the DMZ with the internal network, eliminating segmentation and increasing the blast radius.
- ✗
Expose the database port to the internet so administrators can connect faster.
Why it's wrong here
Opening database ports (e.g., 3306, 1433) to the internet is a critical misconfiguration because it allows anyone to attempt direct authentication and exploit vulnerabilities. Administrative convenience does not justify public exposure; secure remote admin should use a VPN or jump host with MFA.
- ✗
Use the guest wireless VLAN for both systems.
Why it's wrong here
Guest wireless networks are intended for untrusted devices like visitors and are typically isolated from internal resources with limited egress. Hosting production systems there places them in an untrusted trust zone, subject to interference and lacking necessary security controls like enterprise firewall policies and monitoring.
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
TCP
TCP is a connection-oriented transport layer protocol that ensures reliable, ordered, and error-checked delivery of data between applications over IP networks.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.