SY0-701 Security Architecture Practice Question
Exhibit
VLAN and ACL summary: - VLAN 10 User PCs: access to file and print services - VLAN 30 Backup network: access to BackupSrv only - Current rule added last week: permit ip VLAN10 any -> VLAN30 any - BackupSrv -> VLAN10 tcp/445 allowed for restore jobs Concern: ransomware on a user PC could now reach backup repositories.
Based on the exhibit, which change best reduces the blast radius if a user workstation is compromised?
⚠ Common exam trap
Many exam-takers think adding more allow rules (Option A) improves flexibility, but in security architecture, reducing unnecessary access paths is key to minimizing blast radius, not increasing connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove direct user access to the backup VLAN and allow only the dedicated backup path.
Removing direct user access to the backup VLAN and allowing only the dedicated backup path enforces network segmentation, which limits lateral movement. If a workstation in VLAN 10 is compromised, an attacker cannot pivot directly to the backup server in VLAN 30, reducing the blast radius. This aligns with the principle of least privilege and defense-in-depth for backup infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add more allow rules from VLAN 10 to VLAN 30 for SMB and RDP so restore jobs stay flexible.
Why it's wrong here
Opening SMB and RDP from VLAN 10 to VLAN 30 directly expands the attack surface available to any user workstation. SMB is frequently exploited for file-sharing attacks and ransomware propagation, while RDP exposes interactive login capabilities that can be brute-forced or used as a pivot point. Once a single end-user device is compromised, the attacker can leverage these allow rules to reach backup shares and management interfaces, potentially encrypting or deleting critical recovery data. Restore flexibility should be achieved through a dedicated management jump host or scheduled maintenance window, not by widening ACLs from untrusted user zones.
- ✗
Move the backup server into the user VLAN to avoid routing and ACL complexity.
Why it's wrong here
Moving the backup server into the user VLAN places it on the same broadcast domain as the compromised workstation, allowing lateral movement directly to backup data without traversing any ACL or routing boundary. This option is tempting because consolidating resources into a single VLAN reduces network complexity and administrative overhead, which would be a valid approach for non-sensitive services where isolation is not a security requirement.
- ✓
Remove direct user access to the backup VLAN and allow only the dedicated backup path.
Why this is correct
Eliminating direct user access to the backup VLAN is a textbook application of network segmentation and the principle of least privilege. By restricting communication to only the dedicated backup application path—for example, a backup server or agent initiating outbound connections to storage on specific ports—a compromised workstation cannot reach recovery repositories laterally. This containment shrinks the blast radius, ensuring that even if an endpoint is fully controlled by an attacker, the confidentiality, integrity, and availability of backups remain intact, which is essential for incident recovery and ransomware mitigation.
- ✗
Increase the DHCP lease time so backup jobs run less often during business hours.
Why it's wrong here
Adjusting DHCP lease times alters only the frequency at which clients renew their IP configurations; it has no bearing on network access controls, firewall rules, or data flows between VLANs. Backup job scheduling is typically managed by the backup application itself, not by IP lease duration, so changing DHCP settings will not reduce the frequency of backup traffic or the exposure of the backup network. In fact, longer leases could slightly increase the window for an attacker to maintain a valid IP address on a compromised device, offering no security benefit and potentially hampering network management.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Remote Authentication Dial-in User Service
RADIUS is a network protocol that provides centralized authentication, authorization, and accounting for users trying to connect to a network service.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.