SY0-701 Security Architecture Practice Question
An online retailer is redesigning a network for a public web app. Customers must reach only the web tier from the internet. The web tier must reach the application tier, and the application tier must reach the database tier. Which two design changes best support this zoning model? Select two.
⚠ Common exam trap
Candidates often confuse a flat VLAN with host firewalls as sufficient segmentation, not realizing that host firewalls can be disabled or bypassed once an attacker gains local access, whereas network-layer segmentation (e.g., DMZ and separate internal zones) provides a more robust security boundary that is harder to circumvent.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Put the internet-facing web tier in a DMZ with tightly filtered inbound rules.
Placing the internet-facing web tier in a DMZ (demilitarized zone) with tightly filtered inbound rules ensures that external users can only reach the web servers, while the DMZ network isolates them from internal tiers. This aligns with the principle of defense in depth, where the DMZ acts as a buffer zone, and inbound rules (e.g., allowing only TCP/443 for HTTPS) minimize the attack surface. The web tier can then initiate outbound connections to the application tier through a firewall with specific allow-lists, maintaining strict segmentation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place all three server tiers on the same flat VLAN and rely on host firewalls.
Why it's wrong here
A flat VLAN collapses the web, application, and database tiers into one broadcast domain, so there is no network-layer boundary to stop an attacker who compromises the web server from directly reaching the database. Host-based firewalls are software-dependent, easily misconfigured, and often disabled during troubleshooting, making them an unreliable substitute for enforced segmentation. Without separate subnets and dedicated filtering rules, east-west traffic flows freely between every tier.
- ✓
Put the internet-facing web tier in a DMZ with tightly filtered inbound rules.
Why this is correct
Placing the web tier in a DMZ creates a controlled buffer zone between the public internet and trusted internal networks, with stateful firewalls enforcing tightly scoped forward rules that allow only HTTP/HTTPS inbound and specific outbound calls to the application tier. This minimizes attack surface while isolating the web servers from direct access to databases or internal hosts, so a breach at the edge does not automatically expose backend services. The DMZ sits on its own subnetwork, making it the only segment with a public presence.
- ✗
Give the database server a public IP address so the web tier can connect faster.
Why it's wrong here
Assigning a public IP to the database server removes the network address translation boundary, making the database directly routable from the internet and exposed to remote exploitation, credential stuffing, or data exfiltration attempts. Even if strong authentication is used, attackers gain a direct attack surface that bypasses the application tier's normal access controls. The connectivity speed improvement is negligible compared to the catastrophic risk of exposing raw data storage to the public network.
- ✓
Place the application and database tiers in separate internal zones with firewall allow-lists between them.
Why this is correct
Segmenting the application and database tiers into distinct internal zones with intervening firewalls enforces a strict allow-list policy, so only specific ports and protocols needed for the application's function can traverse the boundary. This prevents an attacker who compromises the application server from arbitrarily connecting to the database unless the compromised server is launching exactly the whitelisted traffic. Such east-west micro-segmentation dramatically reduces the blast radius of any single-tier breach and protects the confidentiality and integrity of stored data.
- ✗
Use a single NAT device for all servers and disable interserver filtering.
Why it's wrong here
A single NAT device merely performs IPv4 address translation, providing no inter-zone traffic inspection or firewalling between the web, application, and database servers behind it. Disabling interserver filtering eliminates all access control between tiers, meaning any compromised server can freely initiate connections to any other server on the internal network. This creates a flat trust environment, essentially forfeiting the security benefits that network segmentation would provide for east-west traffic.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
TCP
TCP (Transmission Control Protocol) is a core internet protocol that ensures data is sent reliably and in order between devices over a network.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.