SY0-701 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Telnet to the switches over a router port-forward rule.

  Why it's wrong here

  Telnet over a router port-forward rule is dangerously insecure because Telnet transmits all data, including login credentials and configuration commands, in cleartext across the network. An attacker who captures the traffic can easily retrieve the enable password and silently alter the switch configuration. Additionally, exposing the Telnet service (TCP 23) to the internet via a port-forward increases the attack surface, making the switch discoverable and vulnerable to brute-force and protocol-level attacks. Even if source IP restrictions are applied, the lack of encryption and the permanent availability of the service remain severe flaws.

• ✗

  SSH directly to the switches from the internet using password-only authentication.

  Why it's wrong here

  While SSH encrypts the session and protects against eavesdropping, allowing direct SSH access to the switch from the internet means the management interface is continuously exposed to the entire internet. Password-only authentication relies solely on a shared secret, making the system vulnerable to online password guessing, credential stuffing, and dictionary attacks, especially if weak or reused passwords are in place. Direct internet exposure also violates the principle of least exposure and eliminates the opportunity for centralized monitoring and control, whereas a VPN plus bastion host provides necessary defense in depth.

• ✗

  Use SNMPv2c with restricted source IP addresses.

  Why it's wrong here

  SNMPv2c is fundamentally insecure for administrative access because it uses community strings as a plaintext shared secret, transmitted without encryption. An attacker who sniffs the community string gains full read-write access to switch management information, and these strings are often weak, never rotated, and not tied to individual users. Restricting source IP addresses only blocks obvious unauthorized sources but does nothing to mitigate sniffing, community-string guessing, or the lack of accountability. Furthermore, SNMPv2c is designed for monitoring and configuration retrieval, not interactive commands, so it cannot replace the secure administrative session that SSH through a bastion host provides.

• ✓

  Connect through a VPN to a bastion host, then use SSH to the switches.

  Why this is correct

  This is the correct approach because it layers multiple security controls: the VPN establishes an encrypted tunnel and authenticates users before any traffic enters the data center network, effectively hiding the switch management interfaces from public visibility. The bastion host serves as a controlled jump point, ensuring that only authorized administrators can initiate SSH connections to the switches and providing a centralized point for logging, auditing, and additional authentication factors. Using SSH from the bastion to the switches guarantees encryption and integrity, and it allows key-based or multi-factor authentication, resulting in a robust, traceable, and secure management path.

Go deeper

Related to this question