SY0-701 Security Architecture Practice Question
A company is publishing an internet-facing customer portal that must also query an internal database containing order history. Security wants to reduce the chance that a compromise of the portal exposes the database directly. Which design is the best choice?
⚠ Common exam trap
Test-takers frequently confuse NAT with a security control, thinking it hides the database from attackers, but NAT alone provides no access control or network segmentation, so a compromised portal can still reach the database if they share a network.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the portal in a DMZ and keep the database on an internal network with firewall rules allowing only required traffic.
Placing the portal in a DMZ and keeping the database on an internal network with firewall rules that permit only required traffic (e.g., specific ports like 1433/TCP for SQL Server or 3306/TCP for MySQL) creates a defense-in-depth architecture. This design ensures that even if the web server is compromised, the attacker cannot directly access the database from the internet, as the internal network is isolated by the firewall and only allows traffic from the DMZ to the database on necessary ports.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place the database in the same subnet as the web server and rely on host-based antivirus.
Why it's wrong here
Placing the database in the same subnet as the public-facing web server eliminates any network trust boundary, meaning a single compromised host gives attackers unrestricted access to both systems. Host-based antivirus operates at the individual endpoint and cannot inspect or block the east-west network traffic that would carry malicious database queries or data exfiltration. This design conflates external exposure with internal assets, violating the principle of least privilege and fail-closed network access.
- ✓
Place the portal in a DMZ and keep the database on an internal network with firewall rules allowing only required traffic.
Why this is correct
This is the correct architecture because it establishes a clear trust boundary: the web portal sits in a DMZ with limited access, while the database remains on an internal network with granular firewall rules permitting only the specific SQL service ports and source IPs from the portal. Even if the portal is compromised, the attacker faces an additional firewall layer that restricts traffic to the internal database, preventing direct internet exposure and minimizing the blast radius by requiring legitimate application flow only. This aligns with a defense-in-depth strategy that separates public-facing services from sensitive data stores.
- ✗
Use NAT so the internal database does not have a public IP address.
Why it's wrong here
NAT only masks the database's IP address from the public internet, but it does not enforce any security policy between the web portal and the database. If the portal is compromised, the attacker can still pivot to the database using the internal network because NAT does not filter traffic based on application or port. Proper segmentation requires separate network zones and firewall rules, not just address translation.
- ✗
Move both systems behind a VPN and require users to authenticate before visiting the portal.
Why it's wrong here
Requiring a VPN before accessing the portal forces all users to authenticate through an encrypted tunnel, but the portal is explicitly internet-facing, so making it VPN-only defeats its public purpose and adds complexity for end users. More critically, placing both the web server and database behind the VPN puts them on the same trusted network segment, allowing lateral movement after a portal compromise—the VPN does not create any internal trust boundary or firewall separation between the two tiers. This approach solves a remote-access problem, not the data-isolation and exposure-reduction problem described in the scenario.
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.