SY0-701 Security Architecture Practice Question
An organization is redesigning its office network. Guest Wi-Fi must reach the internet only, employee laptops need access to internal apps, and a payment-processing system must be separated from general user traffic but still reach one database server. Which design best meets these requirements?
⚠ Common exam trap
Test-takers frequently think a DMZ is always the correct answer for any sensitive system, but in this scenario, the payment system needs controlled access to an internal database, not internet exposure, making VLAN segmentation with firewalls the proper design.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create separate VLANs or subnets for guest, user, and payment zones, then filter inter-zone traffic with firewalls or ACLs.
It uses VLANs or subnets to segment guest, employee, and payment-processing traffic into separate broadcast domains, then applies firewall rules or ACLs to control inter-zone traffic. This allows guest Wi-Fi to be restricted to internet-only access, employee laptops to reach internal apps, and the payment system to communicate only with its specific database server while being isolated from general user traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place all devices on one flat network and rely on host firewalls for isolation.
Why it's wrong here
A flat network allows every endpoint, including unmanaged guest devices, to communicate directly with payment systems and user workstations. Relying solely on host firewalls shifts security to each device, which is impractical for guest devices that are unknown and often lack proper configurations. This design also eliminates defense in depth, so a single compromise can lead to lateral movement across the entire office network.
- ✓
Create separate VLANs or subnets for guest, user, and payment zones, then filter inter-zone traffic with firewalls or ACLs.
Why this is correct
This approach creates separate Layer 2 segments (VLANs or subnets) for guest, user, and payment zones, and then applies firewall or ACL rules between them. By enforcing least-privilege connectivity—allowing only the specific ports and protocols needed for business purposes—it prevents lateral movement from compromised guest or user devices into the payment environment. This is the standard segmentation practice required for compliance frameworks like PCI DSS.
- ✗
Put the payment system in a DMZ and allow direct internet access for database synchronization.
Why it's wrong here
A DMZ is intended for services that must be reachable from untrusted external networks, such as a web server. Placing the payment system there and granting direct internet access for database synchronization exposes sensitive financial data and creates an unnecessary attack surface. Payments should be isolated in a restricted internal zone, and any synchronization should use secure, controlled channels like a VPN rather than direct internet exposure.
- ✗
Use NAT on every endpoint so internal devices cannot be individually identified on the network.
Why it's wrong here
NAT merely translates private source addresses to a public address and does not enforce any access control or traffic filtering between internal zones. Relying on it for protection gives no mitigation against malicious lateral movement because once a packet reaches a host, NAT has no role in deciding whether that host may communicate with another. Additionally, NAT complicates logging and forensic analysis because all hosts behind the NAT appear with the same IP.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Segment
A segment is a division of a larger network, such as a collision domain, broadcast domain, or a portion of a TCP data stream, used to organize traffic and improve performance.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An office wants finance workstations separated from general user PCs, but employees still need to print to a shared printer and access one accounting application. Which change best supports this?
easy- A.Place all systems on one VLAN and rely on strong passwords.
- ✓ B.Move finance systems to a separate VLAN or subnet and allow only required traffic through filtering rules.
- C.Put the printer in a different building to make it more secure.
- D.Enable screen lock timers on the finance PCs and keep the network flat.
Why B: Placing finance systems on a separate VLAN or subnet with a Layer 3 boundary enforces network segmentation, which limits broadcast domains and restricts lateral movement. By configuring access control lists (ACLs) or firewall rules to permit only the required traffic (e.g., SMB/CIFS for printer sharing and specific TCP/UDP ports for the accounting application), the organization achieves a least-privilege network architecture. This approach aligns with the principle of defense-in-depth, reducing the attack surface while maintaining necessary business functionality.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.