ExamworthyExamworthy
Open the appStart free

SY0-701 - Security Architecture - Section 3.2

Given a scenario, apply security principles to secure enterprise infrastructure.

Apply network segmentation, firewall rule sets, VPN configurations, and port security to harden enterprise infrastructure against both internal and external threats. Determine correct device placement - such as positioning firewalls and IDS sensors at network boundaries - and justify each decision in terms of the security principle it enforces.

network segmentationfirewallssecure communication/VPNdevice placementport security

Practice question for this objective

Free sampleSecurity Architecturehard

An access switch in a corporate meeting room has eight wall ports patched to user desks. After an incident in which a contractor plugged a small unmanaged switch into one port and connected three personal devices, the network team must harden the access layer. They want each port to learn one legitimate device, drop traffic from any additional MAC address, and shut the port automatically when a violation is observed. Which configuration best meets these objectives?

  • ADisable spanning tree on the meeting room ports and rely on BPDU filtering so that any additional bridge plugged into the port is ignored by the access layer.
  • BConfigure DHCP snooping with a static binding for one device per port so any host without a matching binding is denied an address by the local DHCP server.
  • CPlace all meeting room ports in a guest VLAN with broadcast storm control enabled and a low bandwidth cap per port to discourage tethered devices.
  • DEnable port security on each access port with a maximum of one MAC address learned dynamically and configure the violation action to err-disable the port on any additional source MAC. Correct
Apply port security with a tight MAC limit and an err-disable violation action when the requirement is to enforce one device per access port. Switch port security enforces a configurable upper bound on source MAC addresses observed on a single port and supports a violation action that shuts the port down, which is the canonical control for preventing unauthorised hubs or rogue switches at the access layer. DHCP snooping, storm control, and BPDU filtering address different problems and do not cap the number of attached devices.

Why A is wrong: Disabling spanning tree removes loop protection and BPDU filtering on its own does not cap the number of source MAC addresses; a smart attacker simply uses an unmanaged switch and the extra hosts still get connectivity.

Why B is wrong: DHCP snooping only stops rogue DHCP traffic; an attacker can statically assign IP addresses on the unauthorised devices and continue communicating, so the port is not protected at layer two.

Why C is wrong: A guest VLAN with storm control limits noisy behaviour but allows any number of hosts on the port, so the contractor's unmanaged switch still passes traffic for several devices without triggering any shutdown.

Why D is correct: Port security with a one-MAC limit and an err-disable violation action enforces exactly the requirement: a single learned device per port and an automatic shutdown when a second MAC appears, which neutralises the rogue switch scenario.

See more SY0-701 practice questions, answers explained.

More in this domain

Back to all Security Architecture objectives, or the SY0-701 cert hub.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.