SY0-701 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  VLAN: Separates broadcast domains logically

  Why this is correct

  A VLAN creates logically isolated Layer 2 broadcast domains on the same physical switch infrastructure. By tagging frames with 802.1Q VLAN IDs, switches restrict broadcast, multicast, and unknown-unicast traffic to only ports in the same VLAN, reducing unnecessary propagation and improving security. This logical separation also lets administrators group devices by function or department without rewiring, while inter-VLAN routing is still required for communication between VLANs.

• ✓

  Subnet: Divides IP networks into smaller segments

  Why this is correct

  Subnetting divides a larger IP address block into smaller, routable subnetworks, each with its own network address and broadcast address. This hierarchical partitioning reduces routing table size, improves address allocation efficiency, and supports traffic isolation by controlling which subnets can route to one another through Layer 3 devices. Unlike VLANs, which operate at Layer 2, subnets are a logical IP-layer construct that defines the boundaries for IP routing and broadcast delivery.

• ✓

  DMZ: Isolates public servers from internal network

  Why this is correct

  A DMZ (demilitarized zone) is a perimeter network segment that sits between the public internet and the internal corporate LAN, typically via firewall rules that enforce strict traffic flows. Public-facing servers such as web, email, or DNS are placed here so that if an attacker compromises them, they do not have direct internal network access. The DMZ uses policies that allow only specific inbound ports (e.g., 80/443) to reach the zone, while internal networks initiate outbound sessions only as needed, containing potential breach impact.

• ✗

  ACL: Divides IP networks into smaller segments

  Why it's wrong here

  This statement is incorrect because access control lists (ACLs) do not divide IP networks; they are ordered rule sets used by routers or firewalls to filter packets based on attributes like source/destination IP, port, or protocol. The action of dividing an IP network into smaller segments is performed by subnetting, which changes the network mask and creates distinct address ranges. An ACL might be applied at a subnet boundary, but it never changes the underlying network topology or address segmentation.

• ✗

  NAT: Provides secure remote access over public internet

  Why it's wrong here

  This statement is incorrect because NAT (Network Address Translation) only rewrites IP addresses and port numbers in packet headers as traffic flows between networks, typically allowing internal private addresses to reach the public internet using one or more public IPs. It does not provide encryption, authentication, or any confidentiality mechanism, which are the core functions of a VPN (Virtual Private Network). While NAT can affect which remote connections are possible, secure remote access requires IPsec, TLS, or other tunneling protocols, so crediting NAT with that capability conflates address translation with VPN security.

Go deeper

Related to this question