SY0-701 Security Architecture Practice Question
Exhibit
VLAN table: - VLAN 20 Users: 10.20.20.0/24 - VLAN 30 Finance: 10.20.30.0/24 - VLAN 40 Printers: 10.20.40.0/24 - VLAN 50 Accounting App: 10.20.50.0/24 Current SVI routing policy: permit ip any any Management goal: Finance devices must not initiate traffic to User VLAN 20, but they must be able to print and access the accounting application.
Based on the exhibit, which network change best isolates finance workstations from general user PCs while still allowing printing and application access?
VLAN table:
- VLAN 20 Users: 10.20.20.0/24 - VLAN 30 Finance: 10.20.30.0/24 - VLAN 40 Printers: 10.20.40.0/24 - VLAN 50 Accounting App: 10.20.50.0/24
Current SVI routing policy:
permit ip any any
Management goal: Finance devices must not initiate traffic to User VLAN 20, but they must be able to print and access the accounting application.
⚠ Common exam trap
Many candidates assume VLANs alone provide security isolation, forgetting that by default inter-VLAN routing permits all traffic (as shown by the 'permit ip any any' SVI policy), so additional ACLs are required to enforce directional restrictions while still allowing specific services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add inter-VLAN ACLs that deny Finance VLAN access to User VLAN 20 while permitting Finance VLAN traffic to VLAN 40 and VLAN 50.
It uses inter-VLAN ACLs to enforce the principle of least privilege: denying traffic from the Finance VLAN (10.20.30.0/24) to the User VLAN (10.20.20.0/24) while explicitly permitting traffic to the Printer VLAN (10.20.40.0/24) and the Accounting App VLAN (10.20.50.0/24). This preserves the required segmentation and still allows the necessary services (printing and application access) without altering the existing VLAN structure or routing policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Put finance workstations on the same VLAN as the printers to simplify access.
Why it's wrong here
Combining finance users with printers reduces segmentation and does not stop finance systems from reaching general user devices. It also makes troubleshooting and access control less precise, which weakens containment if a workstation is compromised.
- ✓
Add inter-VLAN ACLs that deny Finance VLAN access to User VLAN 20 while permitting Finance VLAN traffic to VLAN 40 and VLAN 50.
Why this is correct
This is the best option because it keeps the finance systems isolated from general user devices while still allowing the required business functions. The ACL can allow only the exact destinations and services needed for printing and the accounting application, which reduces lateral movement risk without breaking the workflow. It is a practical example of subnet isolation with traffic filtering.
- ✗
Remove routing between all VLANs and let users print through email attachments.
Why it's wrong here
Removing routing between all VLANs is a brute-force approach that breaks business operations, not just security boundaries. Finance workstations would lose all connectivity to the printer VLAN (VLAN 40) and the accounting application VLAN (VLAN 50), so legitimate printing and application access would fail entirely. Suggesting users print via email attachments introduces data leakage risks (sensitive financial documents traversing mail servers) and does not address the underlying need for controlled inter-VLAN access. Proper isolation should use deny-by-default ACLs that permit only required traffic, preserving functionality while reducing lateral movement.
- ✗
Place the accounting application in the User VLAN so finance devices no longer need segmentation.
Why it's wrong here
Moving the application into the User VLAN expands exposure and weakens the boundary between privileged finance systems and standard endpoints. The better solution is to preserve segmentation and control traffic between zones, not collapse them.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Accounting
Accounting in IT identity and access management is the process of tracking and logging what authenticated users do on a system or network.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.