SY0-701 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Increase the PSK length and rotate it every 30 days.

  Why it's wrong here

  Lengthening the PSK and rotating it periodically does improve brute-force resistance, but the fundamental flaw remains: every client shares the same pre-shared key. Once that key is disclosed—whether by a compromised device, an insider, or a captured handshake—the attacker gains unrestricted access until the key is changed, and changing it requires manual reconfiguration of every authorized device. There is no per-user or per-device authentication, no individual accountability, and no way to revoke a single device's access without affecting the entire network. Enterprise 802.1X, by contrast, issues unique credentials or certificates to each endpoint, enabling granular control and immediate revocation.

• ✓

  Move the SSID to WPA2-Enterprise or WPA3-Enterprise with 802.1X, device certificates, and MDM-based compliance checks.

  Why this is correct

  Enterprise Wi-Fi uses individual authentication instead of a shared passphrase, so access can be tied to a specific user or device. Device certificates and MDM compliance checks strengthen control over enrolled endpoints and make it easier to revoke access for lost or noncompliant devices. This is the most secure and manageable architecture shown by the exhibit.

• ✗

  Hide the SSID and enable MAC address filtering on the access points.

  Why it's wrong here

  Hiding the SSID and filtering by MAC address create only superficial barriers. A hidden SSID is still broadcast in probe requests and can be revealed by deauthentication attacks or passive monitoring of client association frames, while MAC addresses are trivially spoofed using widely available tools. Moreover, MAC filtering imposes a significant administrative burden in dynamic environments, requiring manual updates for every new or replaced device. These controls provide no cryptographic identity verification, no mutual authentication, and no integration with device compliance or lifecycle management, so they fail to address the core weakness of a shared-access wireless network.

• ✗

  Keep the current wireless design and rely on a VPN client for all remote access.

  Why it's wrong here

  A VPN protects data in transit after a device successfully associates, but it does not prevent unauthorized or noncompliant devices from joining the wireless LAN in the first place. If the Wi-Fi itself relies on a shared PSK, any individual with the passphrase can bypass the VPN and directly attack other clients or the network infrastructure, since the VPN does not enforce authentication or posture checks at the wireless layer. Relying on a VPN also assumes the endpoint is already trusted, ignoring the risk of compromised, unmanaged, or out-of-date devices gaining layer-2 access. Enterprise authentication with device certificates and MDM compliance checks closes this gap by validating the device before it can even reach the network.

Go deeper

Related to this question