A company is deploying a new web application that must be accessible to external customers. The security team wants to minimize the attack surface by ensuring that only the web server can communicate with the application server, and only the application server can communicate with the database server. Which infrastructure design should the security team implement?

Place all servers in the same subnet and rely on host-based firewalls on each server to restrict traffic.

Place the web server in the DMZ and the application and database servers on the internal network, with no ACLs between them.

Place all servers in a DMZ and use a single firewall rule to allow all traffic between them.

Place each server in its own subnet and configure network access control lists (ACLs) to allow only the required traffic between subnets.

A security analyst is reviewing logs and notices that a server in the DMZ is sending large amounts of data to an external IP address during non-business hours. The analyst suspects the server may be compromised. Which of the following actions should the analyst take first?

Review the server's application logs to identify the process causing the traffic.

Contact the server's administrator to ask if the traffic is expected.

Isolate the server from the network to stop the data exfiltration.

Ignore the traffic because it is coming from the DMZ, which is designed for external communication.

Which cloud security control is used to restrict network access to cloud resources, such as allowing only specific IP addresses to reach a virtual machine?

Identity and access management (IAM)

CompTIASecurity+

Domain 3Objective 2

Enterprise Infrastructure SY0-701 Practice Questions (Page 4)

Part of the Security architecture domain, which accounts for 18% of the SY0-701 exam. CompTIA does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–11 in this domain), expect 2–3 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

9concepts

18%of the exam

Questions 16–20

16application · medium
A company is deploying a new web application that must be accessible to external customers. The security team wants to minimize the attack surface by ensuring that only the web server can communicate with the application server, and only the application server can communicate with the database server. Which infrastructure design should the security team implement?
Select an answer first
17expert · hard
A security analyst is reviewing logs and notices that a server in the DMZ is sending large amounts of data to an external IP address during non-business hours. The analyst suspects the server may be compromised. Which of the following actions should the analyst take first?
Select an answer first
18foundation · easy
Which cloud security control is used to restrict network access to cloud resources, such as allowing only specific IP addresses to reach a virtual machine?
Select an answer first
19foundation · easy
Which protocol is the secure version of HTTP that encrypts web traffic between a browser and a server?
Select an answer first
20foundation · easy
Which protocol is used to securely manage network devices and servers over an encrypted remote command-line session?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SY0-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “SY0-701” is a trademark of its owner, used for identification only.

Enterprise Infrastructure SY0-701 Practice Questions (Page 4)

Questions 16–20

A security analyst is reviewing logs and notices that a server in the DMZ is sending large amounts of data to an external IP address during non-business hours. The analyst suspects the server may be compromised. Which of the following actions should the analyst take first?

Which cloud security control is used to restrict network access to cloud resources, such as allowing only specific IP addresses to reach a virtual machine?

Which protocol is the secure version of HTTP that encrypts web traffic between a browser and a server?

Which protocol is used to securely manage network devices and servers over an encrypted remote command-line session?

Keep studying — Security architecture