SY0-701 Security Architecture Practice Question
A web application needs to be internet-facing. The web tier must accept public traffic, the application tier should be reachable only from the web tier, and the database must be reachable only from the application tier. Which design best supports this?
⚠ Common exam trap
Many exam-takers assume a single subnet with host firewalls is sufficient for segmentation, but CompTIA tests the understanding that network-level firewalls are required to enforce strict traffic flow between tiers and prevent lateral movement in a multi-tier architecture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a three-tier layout with a DMZ, an application zone, and a database zone separated by firewalls.
It implements a classic three-tier architecture with separate security zones (DMZ, application zone, database zone) each protected by firewalls. This ensures that only the web tier in the DMZ accepts public traffic, the application tier is isolated and reachable only from the web tier via firewall rules, and the database tier is further isolated and reachable only from the application tier. This layered defense aligns with the principle of defense in depth and minimizes the attack surface by enforcing strict east-west traffic segmentation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Put all three tiers on one private subnet and rely on host firewalls.
Why it's wrong here
This design creates a flat network where any compromised host can directly reach the database and web servers without traversing a security boundary. Host firewalls on individual servers are application-dependent and can be misconfigured, and they do not provide the centralized traffic inspection and filtering that network-based firewalls offer. Also, if a host firewall is disabled or bypassed, there is no defense-in-depth.
- ✓
Use a three-tier layout with a DMZ, an application zone, and a database zone separated by firewalls.
Why this is correct
This is the standard security architecture for internet-facing web applications. The DMZ exposes only the web tier to the internet, the application tier is isolated in a private zone, and the database is in a further restricted zone. Firewalls enforce strict allow-lists between zones, so even if the web server is compromised, the attacker cannot directly access the database—they must go through the application tier, which provides an additional layer of defense and monitoring. This aligns with the principle of defense in depth.
- ✗
Place the database in the DMZ so the web tier has lower latency.
Why it's wrong here
While putting the database in the DMZ may reduce network hops and latency for the web tier, it directly exposes the database server to internet-facing threats. A database in the DMZ must be accessible from the internet if misconfigured, and even with strict rules, it becomes a high-value target in a zone designed for less trusted traffic. The minimal performance gain does not justify the significant increase in attack surface; proper network design should prioritize security over negligible latency.
- ✗
Use NAT for the database server and allow inbound access from the internet.
Why it's wrong here
Network Address Translation only hides the internal IP address; it does not provide authentication, filtering, or risk mitigation. Allowing inbound internet access to the database server, even via NAT, means the database is reachable directly from untrusted networks, bypassing the multi-tier isolation and exposing sensitive data to potential direct attacks. Also, NAT does not address the need for stateful perimeter defense and would require exposing the database service on the public interface, which is unacceptable for a backend data store.
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Defense in depth
Defense in depth is a cybersecurity strategy that uses multiple layers of security controls to protect information and systems, so if one layer fails, another layer is already in place to stop the attack.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.