SY0-701 Security Architecture Practice Question
An organization is placing its public-facing website behind a new security design. The site must be reachable from the internet, but the database and file servers must stay isolated from direct external access. What design should the architect use?
⚠ Common exam trap
Many exam-takers confuse NAT or VPN as security controls for isolation, when in fact they do not provide network segmentation; the DMZ is the only design that creates a physical or logical boundary to isolate public-facing servers from internal resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a demilitarized zone (DMZ) for the public web server.
A demilitarized zone (DMZ) is a network segment that isolates public-facing services, such as a web server, from the internal network. By placing the web server in the DMZ, the organization allows internet traffic to reach the website while keeping the database and file servers on the internal network, which are not directly accessible from the internet. This design enforces a security boundary where only necessary traffic (e.g., HTTP/HTTPS) is permitted through firewall rules, preventing direct external access to sensitive backend systems.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place the web server on the internal user subnet so it can reach the database directly.
Why it's wrong here
Placing the web server on the internal user subnet would place a publicly reachable service directly beside trusted workstations and internal databases. This eliminates any buffer between the internet and internal assets, so a single web server compromise could expose sensitive data and allow lateral movement across the entire internal network, making it a security worst practice.
- ✓
Create a demilitarized zone (DMZ) for the public web server.
Why this is correct
A demilitarized zone (DMZ) is a physically or logically isolated network segment that sits between the untrusted internet and the trusted internal network. It enforces firewall rules that allow only inbound traffic to the public web server while blocking direct access to internal hosts, ensuring that a breach of the web server does not automatically compromise internal systems.
- ✗
Use a VPN concentrator so the website can be accessed securely from outside.
Why it's wrong here
A VPN concentrator is intended to provide authenticated remote users with secure, encrypted tunnels into an internal network, not to provide anonymous public access to a website. Requiring visitors to authenticate would eliminate the website's public nature, and the VPN would not create a screened-off network segment—it merely extends trusted access, which is unsafe for internet-facing services.
- ✗
Use network address translation (NAT) on the web server to hide its IP address.
Why it's wrong here
Network address translation (NAT) on the web server only hides its internal IP address by rewriting the source or destination addresses in packets. This does not create a protective buffer zone, does not inspect or filter malicious traffic, and does not segregate the web server from the internal network; it is simply an addressing mechanism, not a security control equivalent to a DMZ.
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Hypertext Transfer Protocol Secure
Hypertext Transfer Protocol Secure, or HTTPS, is the secure version of HTTP that encrypts data between a web browser and a website using SSL/TLS to protect sensitive information like passwords and credit card numbers.
Key term
DMZ
A DMZ (demilitarized zone) is a network segment that sits between an internal private network and the public internet, hosting publicly accessible services while keeping the internal network isolated.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.