SY0-701 - Security Architecture (18% of the exam) - Section 3.2

Given a scenario, apply security principles to secure enterprise infrastructure.

Apply network segmentation, firewall rule sets, VPN configurations, and port security to harden enterprise infrastructure against both internal and external threats. Determine correct device placement - such as positioning firewalls and IDS sensors at network boundaries - and justify each decision in terms of the security principle it enforces.

network segmentationfirewallssecure communication/VPNdevice placementport security

Practice question for this objective

Free sampleSecurity Architecturehard

An access switch in a corporate meeting room has eight wall ports patched to user desks. After an incident in which a contractor plugged a small unmanaged switch into one port and connected three personal devices, the network team must harden the access layer. They want each port to learn one legitimate device, drop traffic from any additional MAC address, and shut the port automatically when a violation is observed. Which configuration best meets these objectives?

ADisable spanning tree on the meeting room ports and rely on BPDU filtering so that any additional bridge plugged into the port is ignored by the access layer.
BConfigure DHCP snooping with a static binding for one device per port so any host without a matching binding is denied an address by the local DHCP server.
CPlace all meeting room ports in a guest VLAN with broadcast storm control enabled and a low bandwidth cap per port to discourage tethered devices.
DEnable port security on each access port with a maximum of one MAC address learned dynamically and configure the violation action to err-disable the port on any additional source MAC. Correct

Apply port security with a tight MAC limit and an err-disable violation action when the requirement is to enforce one device per access port. Switch port security enforces a configurable upper bound on source MAC addresses observed on a single port and supports a violation action that shuts the port down, which is the canonical control for preventing unauthorised hubs or rogue switches at the access layer. DHCP snooping, storm control, and BPDU filtering address different problems and do not cap the number of attached devices.

Why A is wrong: Disabling spanning tree removes loop protection and BPDU filtering on its own does not cap the number of source MAC addresses; a smart attacker simply uses an unmanaged switch and the extra hosts still get connectivity.

Why B is wrong: DHCP snooping only stops rogue DHCP traffic; an attacker can statically assign IP addresses on the unauthorised devices and continue communicating, so the port is not protected at layer two.

Why C is wrong: A guest VLAN with storm control limits noisy behaviour but allows any number of hosts on the port, so the contractor's unmanaged switch still passes traffic for several devices without triggering any shutdown.

Why D is correct: Port security with a one-MAC limit and an err-disable violation action enforces exactly the requirement: a single learned device per port and an automatic shutdown when a second MAC appears, which neutralises the rogue switch scenario.

See more SY0-701 practice questions, answers explained.

Exam traps in Security Architecture

Answers that look right on this material and are not. Each one is a distractor from a different question in the SY0-701 bank for this domain.

Place the web server and the SQL database together on the internal corporate LAN and forward inbound TCP 443 to the web server through a single port-forward rule.
Why it is wrong: Port forwarding to an internal web server is tempting because it appears to expose only one port, but it leaves the database on the same trusted LAN reachable from a compromised web host, so it fails both stated requirements.
Split the existing /16 into smaller /24 subnets so each department gets its own broadcast domain, and rely on the existing layer two switches to keep traffic local to each VLAN until it reaches the core router.
Why it is wrong: Splitting broadcast domains reduces broadcast noise and is tempting because it is described as segmentation in many introductory texts, but routed traffic between the new subnets still flows through a switch fabric with no inspection policy, so a compromised laptop can still reach finance servers and controllers across the routed core.
It is the practice of placing every server behind a host-based firewall so that no two servers can communicate without first authenticating to one another over a mutual TLS channel.
Why it is wrong: This conflates segmentation with host-based microsegmentation and mutual authentication. While complementary, host-based firewalls and mutual TLS are not the defining mechanism of segmentation as a network design concept.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.