SY0-701 Security Architecture Practice Question
Exhibit
Current firewall policy excerpt: 1. Allow any source -> WEB01 tcp/443 2. Allow any source -> WEB01 tcp/80 3. Allow ADMIN-SUBNET -> WEB01 tcp/22 4. Deny all other inbound traffic Topology note: WEB01 currently sits on the same subnet as internal application servers.
Based on the exhibit, which change would best reduce the attack surface of the public web server while preserving remote administration from the internal network?
⚠ Common exam trap
Candidates often think placing a server on a separate VLAN or adding filtering is sufficient, but the key is using a DMZ with a reverse proxy to eliminate direct inbound connections and a jump host to control administrative access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Move WEB01 into a DMZ and allow only the reverse proxy or load balancer to reach it on HTTPS, with admin access limited to the jump host.
Moving WEB01 into a DMZ and restricting inbound HTTPS traffic to only the reverse proxy or load balancer minimizes the server's exposure to the internet while still allowing external users to access the web application. Admin access from the internal network is preserved by limiting it to a jump host, which provides a controlled, audited entry point. This architecture follows the principle of least privilege and network segmentation, reducing the attack surface without sacrificing necessary functionality.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign WEB01 a public IP address directly and remove the firewall rules.
Why it's wrong here
Directly exposing the web server with a public IP and no firewall eliminates the perimeter defense provided by the network firewall, making the server reachable from the entire internet. This not only removes the edge security control but also defeats the purpose of a screened subnet or DMZ, expanding the attack surface rather than reducing it. The server's HTTPS service would be directly accessible, and any vulnerability in the web application or TLS stack becomes immediately exploitable from any source.
- ✓
Move WEB01 into a DMZ and allow only the reverse proxy or load balancer to reach it on HTTPS, with admin access limited to the jump host.
Why this is correct
A DMZ creates a separate trust boundary for the internet-facing service, limiting blast radius if the web server is compromised. Restricting inbound access to a proxy or load balancer reduces direct exposure, and allowing administration only from a jump host preserves controlled remote management. This is the strongest architectural improvement in the scenario.
- ✗
Place WEB01 on the same VLAN as user workstations so the firewall can inspect traffic more easily.
Why it's wrong here
Placing the web server on the same VLAN as user workstations flattens the network and eliminates segmentation, so a compromised workstation can reach the server directly without passing through a firewall. This expands lateral movement, as an attacker who gains a foothold on any user device can pivot to the server with Layer 2 adjacency, bypassing network access controls. It would also expose the server to broadcast traffic and local reconnaissance, increasing the overall attack surface rather than containing it.
- ✗
Keep the server where it is and add outbound web filtering to stop exploitation attempts.
Why it's wrong here
Outbound web filtering only inspects traffic leaving the network, leaving the inbound connection from the reverse proxy to the web server untouched and the server still directly reachable via its current rule. While it might help block some C2 callbacks or data exfiltration, it does not reduce the server's exposure to initial exploitation attempts that arrive over the inbound HTTPS channel. The underlying issue is that the web server sits on the internal network with weak ingress controls, so a server-side vulnerability remains globally exploitable.
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.