SY0-701 Security Architecture Practice Question
Exhibit
Guest WLAN uses VLAN 20. Current ACL on the VLAN 20 SVI: - permit udp any eq 53 any - permit udp any eq 67 any - permit ip 10.50.20.0/24 any - deny ip any 10.0.0.0/8 - deny ip any 172.16.0.0/12 - deny ip any 192.168.0.0/16 Default route sends remaining traffic to the ISP. Requirement: guests should have internet-only access.
Based on the exhibit, which change best meets the requirement that guest devices can reach the internet but must not reach any internal subnets or printer VLANs?
⚠ Common exam trap
Candidates often think adding more allow rules (Option A) or using a shared VLAN with a password (Option C) provides sufficient isolation, but they fail to recognize that network-layer segmentation via dedicated zones and firewall rules is required to prevent guest-to-internal communication at both Layer 2 and Layer 3.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Move guests into a dedicated guest zone with outbound NAT and default-deny rules to internal networks.
Placing guest devices in a dedicated guest zone with outbound NAT allows them to access the internet while default-deny rules to internal subnets and printer VLANs enforce network segmentation. This approach uses firewall policies to explicitly block RFC 1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) from guest traffic, ensuring no Layer 3 connectivity to internal resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add more allow rules for the printer VLAN so guests can print without changing routing.
Why it's wrong here
Adding more allow rules for the printer VLAN would create a lateral path from the guest network into an internal segment, letting guests reach not just printing but any device on that VLAN that lacks its own controls. This conflicts with the requirement for internet-only access and expands the attack surface, because the firewall rule would permit guest-originated traffic deeper into the trusted network. Least privilege demands guests remain isolated from all internal VLANs, including printer infrastructure, regardless of whether routing is changed.
- ✓
Move guests into a dedicated guest zone with outbound NAT and default-deny rules to internal networks.
Why this is correct
A dedicated guest zone with outbound NAT and default-deny rules to internal networks satisfies the requirement by placing untrusted guests into their own security zone, one that can reach the internet but cannot initiate traffic to any RFC1918 internal address. The stateful firewall performs source NAT to the public interface, so responses return only for established outbound sessions, while explicit deny rules block guest-to-internal traffic. This enforces least privilege, prevents lateral movement, and keeps guest access strictly internet-only.
- ✗
Place guest and corporate devices on the same VLAN and rely on the wireless password for separation.
Why it's wrong here
Putting guest and corporate devices on the same VLAN eliminates Layer 2 segmentation, so the wireless password only authenticates a client to the AP; it does not stop ARP spoofing, multicast discovery, or direct host-to-host connections after association. Once on the same broadcast domain, a compromised guest can enumerate and attack corporate endpoints without traversing a firewall. True separation requires distinct VLANs or a zero-trust overlay, not a shared subnet relying on a pre-shared key.
- ✗
Allow guest traffic to reach internal DNS and DHCP servers across all RFC1918 subnets.
Why it's wrong here
Allowing guest traffic to reach internal DNS and DHCP servers across all RFC1918 subnets grants guests direct access to critical infrastructure services, creating a large exposure surface and violating the internet-only requirement. Attackers could use internal DNS for reconnaissance or as an exfiltration channel, and DHCP responses from internal servers could hand out corporate addressing or configuration settings to hostile clients. The correct design gives guests only an isolated DNS/boot service or external resolution while denying all access to internal infrastructure.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
NAT
NAT (Network Address Translation) is a method that allows multiple devices on a private network to share a single public IP address when accessing the internet.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.