Free Network Zones and Device Placement practice questions
10 free SY0-801 questions on Network Zones and Device Placement, each with a full explanation — no account needed. This section sits in the Security Architecture part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
A network diagram shows a line labeled 'trust boundary' between the user zone and the server zone. What must exist on that line for it to be a real boundary?
A real trust boundary has an enforcement point that can block traffic, written rules for what may cross, and logs of what crossed and what was refused; a line with nothing on it is only a label. VLANs and subnets implement zones but enforce nothing on their own, and an IDS only watches.
A company is adding Wi-Fi for visitors, who need internet access and nothing else. Which design BEST follows security zone guidance?
A guest network gives visitors internet access only: no route to internal zones, often its own DHCP and DNS, and client isolation so one guest device can't attack another. Putting guests on the corporate VLAN behind an ACL is weaker, because one rule mistake exposes everything, and the screened subnet is for systems the internet must reach.
A web server in the screened subnet accepts inbound connections only on TCP 443, but nothing limits its outbound connections. An attacker exploits it and opens a reverse shell back to their own server. Which rule change would BEST have stopped the reverse shell?
A reverse shell is an outbound connection from the compromised server to the attacker, so egress rules that block the screened subnet's outbound traffic, apart from an approved update path, stop it. Narrowing inbound access doesn't help once the server is already exploited, and opening a path to domain controllers widens the boundary instead of tightening it.
A retailer wants to cut the number of systems in scope for its PCI DSS assessment. Which zone design BEST achieves this?
Isolating the cardholder data environment in its own restricted zone, reachable only from the payment application servers, keeps the rest of the network out of assessment scope. Encrypting the data protects it but isn't segmentation: it stays on a network shared with every internal system, so nothing leaves scope, and the screened subnet puts sensitive data one exploit from the internet.
An architect must make sure an attacker would have to get through two separate devices to reach internal systems from the internet. Which screened subnet design meets this requirement?
A dual-firewall design puts the screened subnet between an external and an internal firewall, so reaching internal systems means defeating two devices. A three-legged firewall is the tempting choice, but one firewall with three interfaces is still a single device, and an NGFW with an IPS engine is also one box.
A team installs an inline IPS between the edge router and the perimeter firewall. Analysts are flooded with alerts about probes of ports the firewall blocks anyway. Where should the IPS go instead?
Behind the perimeter firewall, the IPS inspects only traffic the firewall has already allowed, so its capacity and alerts focus on attacks that could reach a server. A mirror port would turn it into an IDS that can't block, and the management and restricted zones aren't on the path of internet traffic.
A SIEM in the management zone must receive logs from servers in five other zones. The firewall team doesn't want hundreds of new rules allowing servers into the management zone. Which design BEST fits?
A collector in each zone gathers local logs and forwards them across the boundary on one approved flow, so the SIEM accepts connections from a few collectors instead of hundreds of servers. Moving the SIEM into the screened subnet would put a critical security system in the zone built on the assumption that it will be attacked.
Investigators need a complete copy of the traffic on a heavily used link, including malformed frames, and the capture may later be used as evidence. What should feed the capture tool?
A network tap copies everything flowing in both directions and doesn't depend on the switch, which matters when a capture may become evidence. A SPAN port is the tempting choice, but it can drop packets when mirrored traffic exceeds the monitoring port's speed, and it usually discards malformed frames.
A company wants every employee's web request filtered and logged, and it sets the perimeter firewall to block workstations that try to connect straight to the internet. Which device do users' browsers send their web requests to instead?
A forward proxy acts for clients going out: browsers send their requests to it, it filters and logs them, and the firewall allows outbound web traffic only from the proxy. A reverse proxy and a WAF act for servers taking requests in, and an IDS on a mirror port only watches a copy of the traffic.
A company wants any unknown device plugged into an office wall jack to land in a quarantine VLAN before it can reach anything. Where should this control be enforced?
NAC is enforced where devices connect, on access switches and wireless access points, so 802.1X can hold an unknown device in a quarantine VLAN before it reaches anything. The RADIUS server is the tempting answer, but it makes the policy decision behind the switches rather than enforcing it at the port, and a perimeter firewall checks far too late.
Study this section
Every lesson that covers Network Zones and Device Placement on the SY0-801 exam.