SY0-701 Security Architecture Practice Question
A company is placing its public web server so internet users can reach it, but the database server must stay hidden from the internet and be reachable only by the web server. Which design best supports this goal?
⚠ Common exam trap
Watch out — candidates often think placing the database server in the DMZ is acceptable because it is 'protected' by a firewall, but they overlook that the DMZ is still accessible from the internet, making the database directly reachable and violating the requirement to keep it hidden.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the web server in a DMZ and keep the database server on the internal network
It uses a DMZ (demilitarized zone) to isolate the public-facing web server from the internal network. The web server in the DMZ is accessible from the internet, while the database server remains on the internal network, reachable only by the web server through a firewall rule that permits traffic on the specific database port (e.g., TCP 3306 for MySQL). This layered security design prevents direct internet access to sensitive data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Put both servers on the same flat internal network
Why it's wrong here
Placing both servers on the same flat internal network removes any network segmentation between the internet-facing web server and the sensitive database server. If an attacker compromises the web server, they can pivot laterally to the database with no intervening firewall or access control, expanding the blast radius to the entire internal network. This violates the principle of least privilege and fails to isolate untrusted traffic from trusted backend systems.
- ✓
Place the web server in a DMZ and keep the database server on the internal network
Why this is correct
This is the standard DMZ architecture: the web server is placed in a perimeter network (DMZ) that is exposed to the internet but isolated from the internal LAN by firewalls, while the database server remains on the more trusted internal network. Inbound internet traffic is only permitted to the web server, and the web server may establish outbound connections to the database on specific ports or application-level protocols, so even if the web server is compromised, the attacker gains no direct access to the database or other internal resources.
- ✗
Put the database server in the DMZ and the web server on the internal network
Why it's wrong here
This configuration reverses the security levels: the database server, which contains the most sensitive data, is placed in the DMZ directly accessible from the internet, while the web server is placed on the internal network where it is not properly isolated from internal assets. An internet attacker can directly attempt to compromise the database with no filtering, and the internal network becomes the host of an internet-accessible service, breaking the trusted/untrusted boundary. Additionally, the web server's outbound requests to the database would cross from a trusted to an untrusted zone, creating insecure and complex firewall rules.
- ✗
Disable the firewall so the web server can communicate freely with all hosts
Why it's wrong here
Disabling the firewall removes the only security control that enforces segmentation and filters traffic between trust zones. The internet-accessible web server would then be able to communicate freely with all internal hosts, and inbound connections from the internet would also be unrestricted, allowing attackers to reach internal systems directly. This abolishes any boundary between the DMZ and the internal LAN, defeating the purpose of network segmentation and dramatically increasing the attack surface and risk of lateral movement.
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
SQL
SQL is a standardized programming language used to manage and manipulate relational databases, enabling querying, updating, and data retrieval.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.