SY0-701 Security Architecture Practice Question
An office wants finance workstations separated from general user PCs, but employees still need to print to a shared printer and access one accounting application. Which change best supports this?
⚠ Common exam trap
It's easy for candidates to confuse physical separation (Option C) with logical network segmentation, or assume that strong passwords (Option A) or endpoint controls (Option D) are sufficient substitutes for network-layer isolation, when in fact VLANs and ACLs are required to enforce least-privilege access between different security zones.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Move finance systems to a separate VLAN or subnet and allow only required traffic through filtering rules.
Placing finance systems on a separate VLAN or subnet with a Layer 3 boundary enforces network segmentation, which limits broadcast domains and restricts lateral movement. By configuring access control lists (ACLs) or firewall rules to permit only the required traffic (e.g., SMB/CIFS for printer sharing and specific TCP/UDP ports for the accounting application), the organization achieves a least-privilege network architecture. This approach aligns with the principle of defense-in-depth, reducing the attack surface while maintaining necessary business functionality.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place all systems on one VLAN and rely on strong passwords.
Why it's wrong here
Consolidating all systems onto a single VLAN eliminates any network boundary between user groups; strong passwords only authenticate identity and do not restrict east-west traffic once an attacker gains a foothold. On a flat network, a compromised general-user PC can directly probe finance endpoints, where unpatched services and malware can be exploited without valid credentials.
- ✓
Move finance systems to a separate VLAN or subnet and allow only required traffic through filtering rules.
Why this is correct
This is the best choice because it separates finance systems from general users while still allowing approved services like printing and application access. VLANs or subnets reduce lateral movement, and firewall or ACL rules limit communication to only what is needed. That supports least privilege at the network layer.
- ✗
Put the printer in a different building to make it more secure.
Why it's wrong here
Relocating the printer to another building does not change the network fabric; if the finance workstations and general users remain on the same subnet, the printer and other resources are still reachable via the LAN. Physical distance is irrelevant to logical segmentation and does not enforce least privilege, while introducing costly cross-site print queues and management complexity.
- ✗
Enable screen lock timers on the finance PCs and keep the network flat.
Why it's wrong here
Screen lock timers defend against shoulder surfing or physical tampering at an idle console, but they do nothing to filter or isolate traffic between the flat network's hosts. With no VLAN or ACL separation, any device—infected or malicious—can send packets directly to finance systems, and lateral movement is unrestricted. Endpoint hardening alone cannot substitute for network segmentation.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Attack surface
The attack surface is the total sum of all points in a system, network, or application where an unauthorized user can try to enter or extract data.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.