SY0-701 · Objective 3.2 · Security Architecture
3.2 Securing enterprise infrastructure explained
The official objective: “Given a scenario, apply security principles to secure enterprise infrastructure.” Here is what it means, what candidates mix up, and 3 practice questions that test it.
What objective 3.2 covers
Objective 3.2 is a design objective. Given a network and a requirement, you choose where a device goes, how it is connected and how it should behave when it fails.
Start with infrastructure considerations. Device placement decides what traffic a control can see. Security zones, such as a screened subnet for public-facing servers and internal zones for everything else, group systems by trust level. The attack surface is everything an attacker can reach. Connectivity choices decide how zones talk to each other.
Failure modes are a favourite exam topic. A fail-open device lets traffic through when it fails, which keeps the business running but drops protection. A fail-closed device blocks traffic when it fails, which keeps protection but causes an outage. The right choice depends on what matters more for that system: availability or security.
Device attributes come next. An active device acts on traffic; a passive one only observes. An inline device sits in the traffic path and can block, but if it fails it can interrupt traffic. A device connected through a tap or monitor port (a SPAN port on a switch) gets a copy of traffic, can't block anything and can't slow the network down. This is why an intrusion prevention system is inline and an intrusion detection system is often on a tap.
The objective lists the network appliances to know. A jump server is a single hardened host that administrators go through to reach protected systems. A proxy server makes requests on behalf of clients and can filter and cache. Load balancers spread traffic and can terminate TLS. Sensors feed monitoring. Port security and 802.1X control which devices can use a switch port, with EAP carrying the authentication. Firewall types include web application firewalls, unified threat management appliances and next-generation firewalls, and the exam distinguishes layer 4 filtering (ports and addresses) from layer 7 filtering (the application itself).
Secure communication and access covers VPNs, remote access, tunnelling with TLS or IPsec, software-defined WAN, and secure access service edge (SASE), which combines SD-WAN with cloud-delivered security services. Selecting controls means matching all of this to the stated requirement, not choosing the most powerful device in the list.
What candidates mix up
- Fail-open versus fail-closed: fail-open favours availability, fail-closed favours security.
- IDS versus IPS: an IDS alerts on a copy of traffic; an IPS sits inline and can block.
- Jump server versus proxy: a jump server is for administrators reaching internal systems; a proxy handles user traffic to other servers.
- SD-WAN versus SASE: SD-WAN is the connectivity; SASE adds cloud-delivered security on top of it.
Practice questions for 3.2
From the CertRidge SY0-701 question bank. Try each one before opening the answer.
Question 1
A network sensor must see a copy of all traffic on a segment for detection, but must not be able to block or delay any packets even if the sensor fails. How should it be connected?
- AOut-of-band, via a switch SPAN/mirror port or a passive network tap (as an IDS)
- BInline between the firewall and the core switch, in blocking mode
- COn the sensor's own isolated VLAN with no traffic feed
- DAs the default gateway for all hosts on the segment
Show answer and explanation
Answer: A) Out-of-band, via a switch SPAN/mirror port or a passive network tap (as an IDS)
- AA tap or mirror port feeds the sensor a copy of traffic without being in the forwarding path, so a sensor failure or overload can't drop production traffic. Inline placement (IPS) can block but becomes a potential point of failure/latency.
- BInline placement can block traffic and, if the device fails, can break connectivity — contrary to the requirement.
- CWith no traffic mirrored to it, the sensor can't detect anything.
- DThat puts it directly in the data path as a single point of failure — the opposite of passive monitoring.
Question 2
An inline intrusion prevention system protects a payment network. If the IPS fails, the requirement is that no uninspected traffic may pass, even if that causes an outage. How should the IPS be configured to fail?
- AFail closed
- BFail open
- CAs a passive tap
- DIn monitor-only mode
Show answer and explanation
Answer: A) Fail closed
- AA fail-closed device blocks traffic when it fails, favoring security over availability.
- BFail open lets traffic pass uninspected on failure, which favors availability and violates the stated requirement.
- CA passive tap only receives a copy of traffic and can't block anything in normal operation or on failure.
- DMonitor-only mode alerts without blocking, so it would never enforce the requirement.
Question 3
Administrators must never RDP or SSH to production servers directly from their workstations. Instead they connect to one hardened, heavily monitored host, and only that host can reach the servers. What is this design pattern?
- AA jump box / bastion host
- BAn air gap
- CA honeypot
- DA content delivery network
Show answer and explanation
Answer: A) A jump box / bastion host
- AA jump box is a single hardened, logged entry point placed between admin workstations and sensitive systems, shrinking the attack surface and concentrating monitoring on one chokepoint.
- BAn air gap means no network connection at all between environments; here there is a controlled path via the bastion.
- CA honeypot is a decoy meant to attract and study attackers, not a sanctioned admin access path.
- DA CDN caches and distributes content to users; it is not an administrative access control.
Other Security Architecture objectives
Also: the Security Architecture domain page (18% of the exam), all SY0-701 objectives and the SY0-701 cheat sheet.
Ready for a full SY0-701 practice exam?
Timed practice exams match the real exam's length and domain weights, every result shows your score per domain, and Review Mode re-drills the questions you missed.
Objective numbers and statements from CompTIA's published SY0-701 exam objectives. The explanations and questions are our own. Not affiliated with CompTIA.