This SY0-701 practice question tests your understanding of security architecture. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Topology and ACL summary:
Internet -> Firewall -> DMZ VLAN 10: reverse proxy
Private App VLAN 20: application server 10.10.20.20
Private DB VLAN 30: database server 10.10.30.30
User VLAN 40: internal workstations
ACL summary:
1. permit tcp any -> 10.10.10.10 eq 443
2. permit tcp 10.10.10.10 -> 10.10.20.20 eq 8443
3. permit tcp 10.10.20.20 -> 10.10.30.30 eq 1433
4. deny ip any -> 10.10.30.30
Based on the exhibit, which change best reduces exposure for the public web application while keeping the backend tiers protected?
The current design is:
Internet -> Firewall -> DMZ VLAN 10: reverse proxy
Private App VLAN 20: application server 10.10.20.20
Private DB VLAN 30: database server 10.10.30.30
User VLAN 40: internal workstations
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Topology and ACL summary:
Internet -> Firewall -> DMZ VLAN 10: reverse proxy
Private App VLAN 20: application server 10.10.20.20
Private DB VLAN 30: database server 10.10.30.30
User VLAN 40: internal workstations
ACL summary:
1. permit tcp any -> 10.10.10.10 eq 443
2. permit tcp 10.10.10.10 -> 10.10.20.20 eq 8443
3. permit tcp 10.10.20.20 -> 10.10.30.30 eq 1433
4. deny ip any -> 10.10.30.30
A
Move the database server into the DMZ so the public proxy can reach it directly.
Why wrong: This would increase risk by exposing the database tier closer to the Internet-facing zone. Databases should be among the most protected assets in a multi-tier design, not placed where they are easier to reach from untrusted networks.
B
Keep the reverse proxy in the DMZ and place the application and database servers in private subnets behind it.
This is the best design because it limits Internet exposure to the reverse proxy while keeping the application and database tiers segmented behind internal controls. The proxy can forward only approved traffic to the app tier, and the app tier can talk to the database through tightly defined rules. That preserves function while reducing the attack surface of the more sensitive backend systems.
C
Allow inbound Internet access directly to the application server on 8443, but restrict the database.
Why wrong: Directly exposing the application server creates an unnecessary entry point from the Internet. Even if the database stays restricted, the application server becomes a target for scanning, exploitation, and web attack traffic that the reverse proxy could have absorbed.
D
Collapse all servers into one VLAN and rely on strong passwords for protection.
Why wrong: This removes segmentation entirely and does not address network-level exposure. Strong passwords are important, but they cannot replace isolation between public, application, and database systems in a secure architecture.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Keep the reverse proxy in the DMZ and place the application and database servers in private subnets behind it.
Option B is correct because it maintains the defense-in-depth architecture: the reverse proxy in the DMZ (VLAN 10) terminates external HTTPS (TCP/443) and forwards only necessary traffic to the application server in a private VLAN (VLAN 20) over TCP/8443, while the database server remains isolated in a separate private VLAN (VLAN 30) with strict ACLs. This layered segmentation ensures that the public web application's exposure is limited to the reverse proxy, and backend tiers (app and DB) are not directly reachable from the internet, reducing the attack surface while preserving functional separation.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Move the database server into the DMZ so the public proxy can reach it directly.
Why it's wrong here
This would increase risk by exposing the database tier closer to the Internet-facing zone. Databases should be among the most protected assets in a multi-tier design, not placed where they are easier to reach from untrusted networks.
✓
Keep the reverse proxy in the DMZ and place the application and database servers in private subnets behind it.
Why this is correct
This is the best design because it limits Internet exposure to the reverse proxy while keeping the application and database tiers segmented behind internal controls. The proxy can forward only approved traffic to the app tier, and the app tier can talk to the database through tightly defined rules. That preserves function while reducing the attack surface of the more sensitive backend systems.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Allow inbound Internet access directly to the application server on 8443, but restrict the database.
Why it's wrong here
Directly exposing the application server creates an unnecessary entry point from the Internet. Even if the database stays restricted, the application server becomes a target for scanning, exploitation, and web attack traffic that the reverse proxy could have absorbed.
✗
Collapse all servers into one VLAN and rely on strong passwords for protection.
Why it's wrong here
This removes segmentation entirely and does not address network-level exposure. Strong passwords are important, but they cannot replace isolation between public, application, and database systems in a secure architecture.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often think moving a server to the DMZ simplifies access (Option A) or that direct internet access to the app server is acceptable (Option C), failing to recognize that the reverse proxy is the only component designed to handle untrusted traffic and that network segmentation is critical for protecting backend tiers from pivot attacks.
Detailed technical explanation
How to think about this question
The reverse proxy in the DMZ acts as a TLS termination point (RFC 5246) and can enforce HTTP-level security headers (e.g., HSTS, CSP) before forwarding requests to the application server on a non-standard port (8443) to avoid port scanning noise. The ACL chain (permit tcp any -> 10.10.10.10 eq 443; permit tcp 10.10.10.10 -> 10.10.20.20 eq 8443; permit tcp 10.10.20.20 -> 10.10.30.30 eq 1433) implements a stateful, least-privilege model where each tier can only initiate connections to the next, and the final deny rule (deny ip any -> 10.10.30.30) prevents any direct access to the database from other VLANs. In a real-world scenario, if the reverse proxy were compromised, the attacker would still need to bypass the application server's authentication and the database's firewall rules, demonstrating defense in depth.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SY0-701 question in full detail.
Security Architecture — This question tests Security Architecture — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Keep the reverse proxy in the DMZ and place the application and database servers in private subnets behind it. — Option B is correct because it maintains the defense-in-depth architecture: the reverse proxy in the DMZ (VLAN 10) terminates external HTTPS (TCP/443) and forwards only necessary traffic to the application server in a private VLAN (VLAN 20) over TCP/8443, while the database server remains isolated in a separate private VLAN (VLAN 30) with strict ACLs. This layered segmentation ensures that the public web application's exposure is limited to the reverse proxy, and backend tiers (app and DB) are not directly reachable from the internet, reducing the attack surface while preserving functional separation.
What should I do if I get this SY0-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.