Defense in Depth Principles for Network Architecture
Which four of the following are key principles of secure network architecture design that help enforce defense-in-depth? (Choose four.)
Quick Answer
The answer is implementing a DMZ, as it is a key principle of defense in depth principles for network architecture that enforces traffic inspection and access controls between zones. By isolating externally facing services like web and email servers from the internal network, a DMZ ensures that even if an attacker compromises a public-facing server, they cannot directly pivot to internal resources, creating a critical security boundary. On the Security+ SY0-701 exam, this concept tests your understanding of layered network segmentation and how each zone enforces specific trust levels; a common trap is confusing a DMZ with a VPN, but remember that a DMZ controls east-west traffic between zones, while a VPN secures north-south remote access. To recall this, use the mnemonic “D-M-Z: Don’t Mix Zones,” emphasizing that public and private networks must never share a direct path.
⚠ Common exam trap
Watch out — candidates often think a single perimeter appliance is sufficient for security, but CompTIA emphasizes that defense-in-depth requires multiple, diverse controls—not a single device—to avoid a single point of failure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing a demilitarized zone (DMZ) for externally facing services
Implementing a DMZ isolates externally facing services (e.g., web, email) from the internal network, ensuring that if an attacker compromises a public-facing server, they cannot directly pivot to internal resources. This is a foundational defense-in-depth layer that enforces traffic inspection and access controls between zones.
Go deeper
Related to this question
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Match each design requirement to the best security architecture control. Use each control once.
hard- ✓ A.Layered security: Defense in depth
- ✓ B.Minimize risk: Least privilege
- ✓ C.Prevent fraud: Separation of duties
- D.Avoid insecure state: Defense in depth
- E.Reduce misconfiguration: Least privilege
- F.Enforce consistently: Separation of duties
Why A: Defense in depth uses layered controls, least privilege minimizes risk, separation of duties prevents fraud, fail secure avoids insecure states, secure defaults reduce misconfiguration, and complete mediation ensures consistent enforcement.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.