SY0-701 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Place all servers on one VLAN and use host firewalls on each system.

  Why it's wrong here

  Placing all servers on a single VLAN with host firewalls fails to enforce the required network segmentation, because the application tier and database would share the same broadcast domain and Layer 2 adjacency, allowing lateral traffic that the host firewall alone cannot reliably block if misconfigured or bypassed. This approach is tempting because host firewalls are a valid defence-in-depth measure for restricting inter-service communication within a flat network, and would be correct in a scenario where physical or virtual network segmentation is not mandated and only host-level controls are acceptable.

• ✓

  Place web servers in a DMZ, application servers in an internal server subnet, databases in a restricted trust zone, and allow administration only through ACLs from a jump host.

  Why this is correct

  This design separates the exposure of each tier and limits traffic to the minimum necessary paths. The web servers can face the internet in a DMZ, while the application and database tiers remain progressively more restricted. ACLs and a jump host also enforce controlled administrative access and reduce direct management exposure.

• ✗

  Place the database servers in the DMZ so the web tier can query them directly from the internet-facing network.

  Why it's wrong here

  Placing database servers in a DMZ directly exposes the most sensitive tier—the one holding customer PII and credentials—to the internet-facing network, violating the principle of least privilege and defense in depth. In a proper tiered architecture, a web server in the DMZ talks only to an application server in an internal subnet, which then queries the database in a restricted trust zone via narrowly scoped firewall rules on specific SQL ports. A compromise of the web layer would otherwise let an attacker reach the database directly, bypassing the application layer's input validation and logging. This design also breaks common compliance frameworks (e.g., PCI DSS) that require strict segmentation of cardholder data from untrusted networks.

• ✗

  Use NAT for all servers and keep every system on the same internal subnet to simplify routing.

  Why it's wrong here

  While NAT hides internal addresses, it does not provide network segmentation or enforce trust boundaries—it is a routing/address-translation technique, not a security control. Keeping every system on the same internal subnet means the web, application, and database tiers share the same Layer 2 broadcast domain, so any compromised server can perform lateral movement and ARP spoofing to reach the database without crossing a firewall. Simplifying routing at the cost of flat network design is a key failure, as it assumes all internal hosts are equally trustworthy, which is seldom true. Proper segmentation via VLANs, subnets, and ACLs is required to isolate tiers by risk level, regardless of NAT usage.

Go deeper

Related to this question