SY0-701 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Place the web server in a DMZ or public-facing zone.

  Why this is correct

  A DMZ is the standard perimeter network for internet-facing services because it provides a controlled buffer between untrusted public traffic and the internal corporate network. By placing the web server in the DMZ, you can open inbound TCP/80 and TCP/443 from the internet while using firewall rules to limit what the web server can access inside the boundary. This ensures that even if the web tier is compromised, the attack is contained to the DMZ and does not grant direct reach into the application or database layers. The DMZ design is a foundational defense-in-depth control for three-tier architectures.

• ✗

  Allow inbound traffic from the internet directly to the application servers.

  Why it's wrong here

  Allowing internet users to connect directly to the application tier bypasses the web tier’s role as the single entry-point and forces those backend servers to become internet-exposed, which dramatically increases their attack surface. Application servers typically hold business logic and may have direct connections to sensitive databases, so exposing them to the internet would allow malicious traffic to reach them without passing through the web server’s filtering or reverse-proxy protection. In a correctly segmented design, only the web server—placed in the DMZ—should accept inbound client sessions; the application tier must never have a public IP or an open inbound ACL from the internet. This is not just a network design preference; it is a security control to prevent direct, unrestricted access to the most critical processing components.

• ✓

  Restrict the application tier so only the web tier can initiate connections to it.

  Why this is correct

  This rule implements the classic 'middle tier' trust boundary by configuring the application layer’s security group or firewall to accept inbound connections only from the web server’s IP address or security group, and not from any other source, including the internet. Because the web server must invoke application logic through well-defined ports (e.g., HTTPS or an internal RPC), this one-way initiation prevents external users or other malicious hosts from talking directly to the app servers. It also enforces the principle of least privilege: the application tier only trusts a single, known source, which reduces lateral movement opportunities if a different segment is compromised. This is a standard cloud security group and on-premises firewall rule for multi-tier applications.

• ✗

  Put the database on the guest Wi-Fi VLAN.

  Why it's wrong here

  The guest Wi-Fi VLAN is intentionally isolated for visitors and is considered an untrusted zone, with no premise of security or internal resource trust. Placing the database—the most sensitive back-end component—on that segment would expose critical data to any guest who joins the Wi-Fi, often without strong authentication or endpoint protection. Even if network isolation is configured, a compromised guest device could pivot to the database, and the VLAN’s purpose (to give internet-only access) directly conflicts with the requirement to protect backend data. A database should reside on a dedicated internal VLAN that only accepts traffic from the application tier, protected by strict firewall ACLs, not on a public-facing guest segment.

• ✗

  Use the same flat network for all three tiers.

  Why it's wrong here

  A flat network provides no segmentation between the web, app, and database tiers, so an attacker who compromises the web tier can directly reach the app tier without traversing any firewall or access control list. This violates the requirement that the app tier must never be reachable from the internet. The temptation is that a flat network simplifies routing and reduces latency between tiers, and it would be correct if all tiers were equally trusted and no internet-facing isolation were needed.

Go deeper

Related to this question