SY0-701 Question 148
Single answer3.1 Compare and contrast security implications of different architecture models.A company is redesigning its customer-facing application after a recent audit found that a compromise of a single web server could provide broad access to internal resources. The security architect wants an approach that limits east-west movement, enforces access based on identity and device posture, and does not assume that traffic from the internal network is trustworthy. Which architecture model best addresses these requirements?
- A
A flat network architecture with all application tiers on the same internal VLAN to simplify monitoring
- B
A zero trust architecture that continuously verifies access requests and segments resources
- C
A hub-and-spoke architecture that centralizes routing through the data center core without changing trust assumptions
- D
A traditional perimeter-based architecture that focuses on strengthening the external firewall and VPN concentrator
Show answer and explanation
Correct answer: B
Explanation
The best answer is zero trust architecture because the scenario specifically calls for reducing lateral movement, enforcing identity- and posture-based access decisions, and removing the assumption that internal network traffic is trustworthy. These are core characteristics of zero trust, as described in guidance such as NIST SP 800-207, Zero Trust Architecture. In contrast, flat networks increase exposure, hub-and-spoke mainly describes connectivity patterns rather than trust enforcement, and traditional perimeter security relies too heavily on the idea that systems inside the boundary are more trustworthy. For Security+, candidates should recognize that architecture models have direct security implications: zero trust improves resilience against internal compromise through continuous verification, least privilege, and segmentation.
- A. Incorrect.
Incorrect. A flat network increases the risk of lateral movement because systems share broad network access with limited segmentation. Although it may simplify some monitoring tasks, it does not meet the requirement to limit east-west movement or to avoid implicit trust of internal traffic.
- B. Correct.
Correct. Zero trust architecture is designed around the principle of 'never trust, always verify.' It assumes no inherent trust based on network location, and it typically uses strong identity validation, device posture checks, least-privilege access, and microsegmentation to reduce lateral movement. This directly addresses the audit findings and the architect's goals.
- C. Incorrect.
Incorrect. A hub-and-spoke model can improve traffic management and centralize controls, but by itself it does not change the security model to identity-centric access or eliminate implicit trust of internal systems. It is a network topology decision, not a complete answer to the trust and segmentation requirements in the scenario.
- D. Incorrect.
Incorrect. A perimeter-based model emphasizes defending the network boundary, but once an attacker gets inside, internal traffic is often treated as more trusted than it should be. This is the exact weakness described in the scenario, where compromise of one web server could expose internal resources.