SY0-701 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Keep guests on the same VLAN and rely on a separate Wi-Fi password.

  Why it's wrong here

  A separate Wi-Fi password only authenticates the wireless client to the access point; it does not change how the network routes or switches frames after a device connects. Once a guest is authenticated, they become a Layer 2 neighbor on the same broadcast domain, giving them direct access to internal hosts, file shares, or management interfaces on the same subnet. Because the guest VLAN is identical to the internal VLAN, there is no segmentation boundary—the password controls who gets onto the Wi-Fi, not where they can go after that.

• ✓

  Place guests on a separate VLAN and block internal access with ACLs.

  Why this is correct

  A VLAN segregates guest devices into a separate Layer 3 subnet, breaking their ability to directly reach internal hosts by IP at Layer 2. The ACLs applied on the router or Layer 3 switch then explicitly deny the guest subnet from accessing internal subnets, while still permitting the guests to reach the internet and necessary services like DHCP and DNS. This creates a defense-in-depth boundary that controls traffic based on network segments, rather than relying on the wireless encryption or address filtering, making it the correct and industry-standard approach.

• ✗

  Use stronger WPA3 encryption on the wireless network and leave the network flat.

  Why it's wrong here

  WPA3 encryption secures the wireless link against eavesdropping and offline password attacks, but its protection ends at the access point. After decryption, the access point forwards guest frames onto the flat LAN as if they were any other Ethernet frame, so guests share the same broadcast domain and can initiate connections to internal hosts without any Layer 3 inspection. Encryption is a confidentiality and integrity control for the radio link—it does not provide isolation or access control between endpoints on the same network segment.

• ✗

  Enable MAC address filtering on the switch and allow all ports to remain in the default network.

  Why it's wrong here

  MAC address filtering is a weak and easily bypassed layer of access control—an attacker can use a packet capture or network scanning tool to identify an allowed MAC address and spoof it on their own client. Even if the filter succeeds in limiting which devices connect, it only checks the hardware address; it does nothing to separate guest traffic into a distinct virtual LAN or restrict which internal IP ranges a guest can reach. Once a MAC has passed the filter, the device is placed on the default flat network with full Layer 2 and Layer 3 access, exactly the same as any internal host.

Go deeper

Related to this question