SY0-701 Security Architecture Practice Question
Exhibit
Access switch VLAN table: VLAN 10 - Corporate workstations - 126 devices VLAN 10 - VoIP phones - 41 devices VLAN 10 - Badge readers - 18 devices VLAN 10 - Cameras - 24 devices VLAN 20 - Guest Wi-Fi - Internet only Incident note: A compromised workstation was able to reach a badge reader and a camera using internal IP addresses.
Based on the exhibit, which network redesign would best limit lateral movement between user endpoints and building systems after a workstation compromise?
⚠ Common exam trap
Many candidates think antivirus or a flat network simplifies management, but the SY0-701 exam specifically tests the principle of network segmentation to contain lateral movement, not just endpoint protection or network simplicity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Separate workstations, phones, badge readers, and cameras into different VLANs with ACLs or firewall rules between them.
Segmenting workstations, phones, badge readers, and cameras into separate VLANs with ACLs or firewall rules between them enforces micro-segmentation. This prevents a compromised workstation from directly initiating lateral movement to building systems (e.g., cameras or badge readers) by restricting inter-VLAN traffic at Layer 3/4, limiting the blast radius of an attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Move every device into a single flat subnet so internal routing is simpler.
Why it's wrong here
Consolidating all endpoints onto a single flat subnet eliminates network segmentation, creating one broadcast domain where any device can directly communicate with any other. This allows a compromised workstation to reach security cameras, badge readers, and phones without traversing a firewall or ACL, and makes lateral movement and ARP spoofing trivially easy. While it simplifies routing, it sacrifices all trust boundaries and containment, directly opposing the security goal of isolation between device classes.
- ✓
Separate workstations, phones, badge readers, and cameras into different VLANs with ACLs or firewall rules between them.
Why this is correct
Separating device classes into distinct VLANs creates clear trust boundaries and limits what a compromised endpoint can reach. Inter-VLAN ACLs or firewall rules can then enforce only the necessary traffic paths, such as management or service traffic. This reduces lateral movement from a workstation to sensitive building systems like cameras and badge readers.
- ✗
Keep the design unchanged and rely on antivirus on the workstations to block access to the cameras.
Why it's wrong here
Endpoint antivirus is a host-based control that inspects files and processes, but it does not inspect or filter network traffic between workstations and cameras. Even if a workstation is clean, a compromised camera could reach out to it, or malware on a workstation could bypass AV and use valid network protocols to access camera management portals. The architecture remains overly permissive because there is no Layer 3 enforcement preventing direct cross-device traffic, so AV cannot stop an attacker already on the workstation from pivoting laterally.
- ✗
Put all traffic through the guest Wi-Fi VLAN to isolate it from the corporate network.
Why it's wrong here
Routing corporate traffic through the guest Wi-Fi VLAN would break essential internal services because guest networks are typically configured with internet-only access and no route to enterprise resources such as printers, servers, or directory services. Moreover, this approach still places workstations, phones, badge readers, and cameras in the same VLAN, so they retain unrestricted east-west communication with each other. It does not create distinct security zones; it merely relocates the flat network into a different VLAN, leaving the same lateral movement and no granular access control between device classes.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Remote Authentication Dial-in User Service
RADIUS is a network protocol that provides centralized authentication, authorization, and accounting for users trying to connect to a network service.
Key term
RADIUS
RADIUS is a network protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.