SY0-701 Security Architecture Practice Question
Administrators need to manage internal switches from home. Management traffic must be encrypted, MFA must be used, and no switch management interface should be exposed directly to the internet. Which design is best?
⚠ Common exam trap
Candidates often think HTTPS encryption alone is sufficient for internet-exposed management, ignoring the requirement that no management interface be directly exposed to the internet, and that MFA must be enforced separately.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a VPN into the internal network, then administer the switches through a hardened jump host over SSH.
It uses a VPN to create an encrypted tunnel from the home user to the internal network, then requires SSH (which encrypts management traffic) through a hardened jump host. This design ensures MFA can be enforced at the VPN or jump host layer, and no switch management interface is directly exposed to the internet, satisfying all three requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Open SSH directly to each switch on a public IP address and restrict access by source IP only.
Why it's wrong here
Exposing SSH on a public IP subjects the switch to continuous internet scanning and brute-force attempts. Source IP filtering is a weak control because an attacker can spoof trusted IPs or compromise a host on the allowed network, and it does nothing to protect against vulnerabilities in the SSH service itself. This approach also violates the architectural goal of keeping all management interfaces strictly on the internal network, making it the opposite of a defense-in-depth remote-access design.
- ✓
Use a VPN into the internal network, then administer the switches through a hardened jump host over SSH.
Why this is correct
This design keeps management interfaces internal, encrypts traffic over the VPN, and lets the organization enforce MFA at the VPN or jump-host entry point. SSH provides secure device administration while the jump host centralizes access and logging.
- ✗
Allow HTTPS management to each switch over the internet because the channel is encrypted.
Why it's wrong here
HTTPS encrypts the session but offers no protection against web-interface vulnerabilities, default credentials, or authentication brute-force attacks when the switch is directly reachable from the internet. Management web servers are not designed to withstand exposure to the open internet—they lack built-in rate limiting, intrusion prevention, and granular access control, so a single unpatched vulnerability can compromise the device. Additionally, this design still places the management port on a public IP, which directly conflicts with the requirement to keep management traffic within trusted networks.
- ✗
Use Telnet inside the office and route home users through a split-tunnel VPN.
Why it's wrong here
Telnet is an unencrypted protocol, so any administrator credentials and switch configurations traversing the network are transmitted in plaintext and can be intercepted with simple packet capture. A split-tunnel VPN only protects traffic destined for the internal network, leaving the remote computer's other internet traffic outside the tunnel and vulnerable to compromise; if that endpoint is infected, it can pivot through the VPN to reach the switches. This combination fails to provide any meaningful security for remote management and is entirely unsuitable for administrative access.
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
VPN
A VPN creates an encrypted tunnel over a public network to securely connect remote users or sites to a private network.
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.