SY0-701 Security Architecture Practice Question
Administrators must manage network switches from home. Requirements: encrypted management traffic, MFA for users, no management ports exposed to the Internet, and centralized logging of admin sessions. Which solution best meets the requirements?
⚠ Common exam trap
Watch out — candidates often think a VPN alone is sufficient, forgetting that the jump host is necessary to avoid exposing switch management ports and to enable centralized logging and MFA enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a VPN with MFA that terminates on a hardened jump host, then reach switches over SSH or HTTPS.
It satisfies all requirements: a VPN with MFA encrypts management traffic, the hardened jump host provides a secure intermediary that keeps switch management ports off the Internet, and centralized logging can be implemented on the jump host to record all admin sessions. This architecture aligns with the principle of defense-in-depth by combining encrypted tunnels, strong authentication, and network segmentation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Open SSH directly on each switch and allow access from the entire Internet.
Why it's wrong here
Directly exposing SSH on each switch to the entire internet turns management interfaces into publicly reachable attack surfaces, inviting brute-force and protocol scans. This approach bypasses centralized security controls such as MFA, logging, and intrusion detection, and it violates the requirement to keep management traffic off the public internet.
- ✓
Use a VPN with MFA that terminates on a hardened jump host, then reach switches over SSH or HTTPS.
Why this is correct
A VPN with MFA that terminates on a hardened jump host provides authenticated, encrypted remote access while ensuring switch management protocols are never exposed directly to the internet. The jump host acts as a controlled pivot point, so administrators reach switches only via SSH or HTTPS after passing both the VPN and MFA, and it centralizes logging and auditing of management sessions.
- ✗
Use port forwarding through the firewall to RDP on each switch.
Why it's wrong here
Port forwarding through the firewall to RDP on each switch is fundamentally flawed because RDP is a desktop remote-management protocol, not the native CLI or web interface used for switch administration. Even with port forwarding, the switch management service remains internet-accessible, bypassing the need for a VPN and failing to enforce MFA or centralized access control, thereby expanding the attack surface for RDP exploits.
- ✗
Build an IPSec tunnel only between office routers and share a common admin password on the switches.
Why it's wrong here
An IPSec tunnel only between office routers does not provide secure home access unless the administrator is literally on the office LAN, and it lacks MFA and per-user accountability. Sharing one admin password on all switches removes audit trails and makes it impossible to trace changes to a specific person, violating least privilege and compromising the security goals of individualized, controlled remote management.
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.