SY0-701 General Security Concepts Practice Question
Exhibit
Simplified network view Internet | Perimeter firewall | User VLAN 10 --------------------------- | Workstations | | File shares | | Domain services | | SSH allowed from User VLAN to all servers | --------------------------------------------- Current rule set: - TCP 22 from any device in VLAN 10 to internal Linux servers - TCP 3389 from any device in VLAN 10 to Windows servers - No dedicated admin network - No bastion host
Based on the exhibit, which change best reduces the risk of lateral movement if a user workstation is compromised?
⚠ Common exam trap
CompTIA often tests the misconception that adding more resources to a VLAN or disabling logging improves security, when in fact these actions weaken segmentation and reduce visibility, respectively.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require administrative access through a hardened bastion host and restrict direct management from user devices.
Requiring administrative access through a hardened bastion host enforces a jump-box architecture, which eliminates direct RDP, SSH, or WinRM from user workstations to servers. This segmentation prevents an attacker who compromises a user workstation from using stolen credentials or tools to laterally move to sensitive servers, as all management traffic must pass through a controlled, monitored, and often multi-factor-authenticated bastion host.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add more workstations to VLAN 10 so authentication requests are faster.
Why it's wrong here
Adding more workstations to VLAN 10 does not address lateral movement; it broadens the trust domain on a segment that already contains sensitive resources. Authentication speed is not a security issue and would be better resolved by improving the authentication infrastructure rather than increasing the number of endpoints on the same VLAN. This change actually enlarges the attack surface an adversary can pivot from after compromising a single user device.
- ✓
Require administrative access through a hardened bastion host and restrict direct management from user devices.
Why this is correct
A bastion host creates a controlled management path instead of allowing every workstation to talk directly to servers. Restricting direct SSH and RDP from the user VLAN reduces attack surface and supports a zero-trust-style approach to administration.
- ✗
Disable logging on the servers so attackers leave fewer traces if they connect.
Why it's wrong here
Disabling logging on servers provides no security benefit and actively harms the organization's ability to detect a compromise. Attackers are not stopped by the absence of logs; they simply operate without a trail, extending the time to discovery and increasing the damage. Contrary to reducing risks, this action violates security best practices that require robust audit logging to support incident response and forensic investigation.
- ✗
Move all servers into the same VLAN as the workstations for easier access control.
Why it's wrong here
Consolidating servers and workstations into one VLAN collapses the network segmentation that normally restricts an attacker’s ability to pivot laterally from a compromised workstation to sensitive server resources. This change directly violates the principle of least privilege at the network layer, as it removes the isolation that a separate server VLAN provides. It is tempting because VLANs are commonly used to simplify access control lists and reduce broadcast domains, and in a flat network where all devices share identical trust levels, merging VLANs could streamline management without introducing additional risk.
Go deeper
Related to this question
Learn chapter
Multi-Factor Authentication (MFA)
Key term
Bastion host
A bastion host is a specially hardened server on a network’s perimeter that allows authorized users to securely access internal systems from outside the network.
Key term
WinRM
WinRM is Microsoft's implementation of WS-Management, enabling secure remote management of Windows systems over HTTP/HTTPS.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.