SY0-701 Security Architecture Practice Question
A company is implementing network segmentation to isolate the guest wireless network from the internal corporate network. Which of the following technologies is most appropriate to enforce this separation at Layer 2?
⚠ Common exam trap
Many exam-takers confuse ACLs as a Layer 2 solution because they are commonly used for filtering, but ACLs operate at Layer 3/4 and cannot create broadcast domain isolation; VLANs are the only Layer 2 mechanism listed that directly segments traffic at the Data Link layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VLANs
VLANs (Virtual Local Area Networks) are the correct technology because they operate at Layer 2 (Data Link layer) of the OSI model, allowing network administrators to logically segment a physical switch into multiple isolated broadcast domains. By assigning the guest wireless network to a separate VLAN (e.g., VLAN 100) and the internal corporate network to another (e.g., VLAN 10), traffic between them is blocked at Layer 2 unless explicitly routed through a Layer 3 device with appropriate firewall rules. This directly enforces separation without requiring additional hardware, making VLANs the most appropriate and efficient choice for isolating guest traffic at Layer 2.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
VLANs
Why this is correct
VLANs (Virtual Local Area Networks) partition a single physical switch into multiple isolated broadcast domains at Layer 2. By assigning guest wireless traffic to a dedicated VLAN, organizations can enforce logical separation from corporate network resources on the same infrastructure, preventing direct client-to-client communication across segments. This segmentation is fundamental because it operates independently of IP addressing and can be extended across switches using trunk links, with inter-VLAN routing only permitted when explicitly configured through a firewall or router. For guest wireless isolation, VLANs are the appropriate primary technology because they provide native Layer 2 isolation that other options cannot match.
- ✗
ACLs
Why it's wrong here
Access control lists (ACLs) are rules applied to routers, switches, or firewalls that filter traffic based on Layer 3 or Layer 4 attributes, such as source/destination IP addresses or TCP/UDP ports. While ACLs can restrict specific traffic flows between guest and corporate subnets, they do not provide the foundational Layer 2 segmentation that prevents broadcast propagation and direct link-layer communication. Without VLANs or similar Layer 2 isolation, ACLs would still allow guest and corporate devices to share the same broadcast domain, meaning ARP, DHCP, and other link-layer broadcast traffic would be visible across segments. ACLs are a complementary control to enforce policy at the network edge, but they cannot substitute for VLANs when the requirement is to isolate guest wireless at Layer 2.
When this WOULD be correct
ACLs would be correct in a scenario where a company needs to filter traffic between two subnets at Layer 3, such as allowing only HTTP traffic from a guest network to the internet while blocking access to internal IP ranges.
- ✗
DMZ
Why it's wrong here
A demilitarized zone (DMZ) is a perimeter network design that hosts publicly accessible services such as web, email, or VPN endpoints, placing them between the internet and the internal LAN. While a DMZ uses VLANs or separate interfaces to segment traffic, the DMZ itself is an architectural pattern, not a mechanism for isolating guest wireless clients from corporate systems. The purpose of a DMZ is to limit exposure of internal assets by mediating inbound and outbound traffic, but it does not inherently create the Layer 2 separation needed for guest wireless isolation. Deploying a DMZ would not satisfy the requirement of isolating guest wireless; instead, it would place guest-facing services in a less trusted zone, which is the opposite of the goal.
When this WOULD be correct
A company needs to host a public web server that is accessible from the internet but isolated from the internal corporate network. Which network architecture should be used?
- ✗
VPN
Why it's wrong here
A virtual private network (VPN) creates an encrypted tunnel that secures data in transit over untrusted networks, such as the internet, for remote access or site-to-site connectivity. VPNs authenticate and encrypt traffic at Layer 3 or higher, but they do not operate at Layer 2 to partition broadcast domains on a local switch. Using a VPN for guest wireless isolation would require each guest device to establish a tunnel, which adds overhead, complicates the user experience, and still fails to prevent direct communication between devices on the same physical LAN. The core function of a VPN is confidentiality and integrity of encapsulated traffic, not internal network segmentation, making it unsuitable as the primary method for isolating guest wireless.
When this WOULD be correct
A VPN would be correct in a scenario where remote users need secure access to the internal corporate network over the internet, and the question asks for a technology to provide encrypted connectivity across an untrusted network.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓VLANsCorrect answer▾
Why this is correct
VLANs (Virtual Local Area Networks) partition a single physical switch into multiple isolated broadcast domains at Layer 2. By assigning guest wireless traffic to a dedicated VLAN, organizations can enforce logical separation from corporate network resources on the same infrastructure, preventing direct client-to-client communication across segments. This segmentation is fundamental because it operates independently of IP addressing and can be extended across switches using trunk links, with inter-VLAN routing only permitted when explicitly configured through a firewall or router. For guest wireless isolation, VLANs are the appropriate primary technology because they provide native Layer 2 isolation that other options cannot match.
✗ACLsWrong answer — click to see why▾
Why this is wrong here
ACLs operate at Layer 3 (IP) or Layer 4 (TCP/UDP), not Layer 2. They cannot enforce separation based on MAC addresses or VLAN tags, which is required for isolating guest wireless from corporate networks at Layer 2.
★ When this WOULD be the correct answer
ACLs would be correct in a scenario where a company needs to filter traffic between two subnets at Layer 3, such as allowing only HTTP traffic from a guest network to the internet while blocking access to internal IP ranges.
Why candidates choose this
Candidates often confuse ACLs with VLANs because both are used for network segmentation, but ACLs filter traffic based on IP addresses and ports, not at the data link layer.
✗DMZWrong answer — click to see why▾
Why this is wrong here
A DMZ is a network segment that hosts public-facing services, not a technology for Layer 2 separation between guest and internal networks. It operates at higher layers and does not enforce Layer 2 isolation.
★ When this WOULD be the correct answer
A company needs to host a public web server that is accessible from the internet but isolated from the internal corporate network. Which network architecture should be used?
Why candidates choose this
Candidates may confuse DMZ as a general isolation mechanism, thinking it can separate guest from internal networks, but DMZ is specifically for external-facing services, not for internal segmentation.
✗VPNWrong answer — click to see why▾
Why this is wrong here
VPNs operate at Layer 3 or above, encrypting traffic between endpoints over an untrusted network, but they do not enforce Layer 2 separation between networks. The question specifically asks for Layer 2 isolation, which VLANs provide by segmenting broadcast domains.
★ When this WOULD be the correct answer
A VPN would be correct in a scenario where remote users need secure access to the internal corporate network over the internet, and the question asks for a technology to provide encrypted connectivity across an untrusted network.
Why candidates choose this
Candidates may confuse VPN with network segmentation because VPNs can logically separate traffic, but they operate at higher layers and are not designed for Layer 2 isolation within a local network.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
Key term
VLAN
A VLAN (Virtual Local Area Network) is a logical grouping of network devices that behave as if they are on the same physical network segment, regardless of their actual physical location.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.