SY0-701 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Require a VPN or ZTNA connection with MFA, then allow SSH or HTTPS management only through that protected tunnel.

  Why this is correct

  A VPN or ZTNA tunnel creates a cryptographically protected path from the engineer's workstation to the internal network, keeping SSH/HTTPS management virtual interfaces off the public internet where they can be targeted by scanners. Enforcing MFA at this boundary adds a strong identity check beyond just the device's own password or key, so a compromised credential alone isn't sufficient. This reduces the attack surface to a single hardened access point and ensures all administrative traffic for the switches traverses an encrypted, authenticated session.

• ✗

  Expose SSH on the internet and rely on key-based authentication alone.

  Why it's wrong here

  Exposing SSH directly to the internet means anyone can attempt to connect to the switch's management interface, and even with key authentication, the service is continuously ripe for brute-force attempts, protocol-level exploits, and denial-of-service attacks. Key-based auth proves the client holds a private key, but it doesn't provide multi-factor assurance or protect against later key compromise or SSH daemon zero-days, which is especially risky on older network device firmware. A more appropriate design would limit SSH to a private management VLAN reachable only through a VPN or ZTNA.

• ✗

  Use RDP with port forwarding because it is simpler for remote support.

  Why it's wrong here

  RDP is designed for remote desktop control of Windows systems, not for administrating network switches, which expect CLI or HTTPS management interfaces; trying to use RDP with port forwarding would require an agent or gateway and still exposes an unnecessary service to the internet. Port forwarding creates a static inbound rule that punches through the firewall, directly exposing RDP to Windows machines and making them prime targets for brute-force and known vulnerabilities like BlueKeep. This approach sacrifices the secure architectural separation of the management plane and has no MFA or tunnel protection, contradicting the principle of least exposure.

• ✗

  Allow split tunneling without MFA so engineers can reduce latency while working remotely.

  Why it's wrong here

  Split tunneling at home typically sends only corporate-tagged traffic through the VPN while internet-bound traffic goes directly from the user's ISP, meaning a compromised home network can intercept or redirect non-tunneled traffic and weaken the overall security posture. More important, allowing access without MFA undermines the remote access control: if an engineer's username and password are phished, the attacker gains direct administrative capability to the switches without a second factor. The latency savings don't justify bypassing a protected tunnel and strong authentication, especially because management traffic contains highly sensitive configuration and credentials.

Go deeper

Related to this question