SY0-701 Security Architecture Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Telnet over port 23 with an allow list on the firewall.

  Why it's wrong here

  Telnet transmits all data, including login credentials and configuration commands, in plaintext, so an attacker positioned on the network path can trivially capture the password and hijack the session. An allow list on the firewall only restricts which source IPs can reach the service; it does nothing to protect the confidentiality or integrity of the management traffic. Additionally, most modern switches disable Telnet by default due to these well-known vulnerabilities, making this approach both insecure and often non-functional.

• ✓

  A VPN into the internal network, then SSH or HTTPS for administration.

  Why this is correct

  This is the best answer because it keeps management interfaces off the public internet while still allowing secure remote administration. The VPN provides encrypted transport and can enforce strong user authentication, and SSH or HTTPS protects the device management session itself. This layered approach matches common best practice for remote admin access and reduces exposure of sensitive management services.

• ✗

  RDP directly to the switch management interface from the public IP address.

  Why it's wrong here

  RDP is a remote display protocol designed for Windows workstations, not the native management interface for network switches, which typically use SSH, HTTPS, or a serial console for administration. Exposing RDP directly from the public IP address invites brute-force attacks against the Windows-based management agent (if one even exists) and amplifies the attack surface with a protocol known for past vulnerabilities. Even if RDP were technically available on the switch, it would lack the device-specific security controls and command authorization needed for safe infrastructure management.

• ✗

  Open the management port to the internet and rely on a long password.

  Why it's wrong here

  Relying solely on a long password to protect a management interface exposed to the internet is inadequate because password-based authentication is vulnerable to brute-force attacks, credential stuffing, and phishing—and a single factor can be compromised. Direct internet exposure also subjects the management service to continuous vulnerability scanning and zero-day exploit attempts without the protective layer of a network boundary. Best practice is to place the management interface behind a VPN or jump host, which adds encryption, strong user authentication, and often multi-factor authentication or device-level access controls.

Go deeper

Related to this question