Choose an access method against a constraint that rules things out

applied · 75 min · Objective 3.2

Task

Work five access requirements through to a recommendation by elimination rather than by preference, and write the justification in the form that survives being challenged: what the constraint rules out, and why.

Steps

  1. Write /tmp/requirements.md with five scenarios: two offices needing permanent connectivity; a contractor needing one internal web application; a requirement that all remote traffic be inspected; poor cloud application performance over the current VPN; and a restrictive guest network that blocks non-standard ports.
  2. For each, list the candidate methods: site-to-site IPSec, clientless TLS VPN, full-tunnel always-on, split tunnel with endpoint controls, ZTNA, and SASE.
  3. Eliminate rather than choose. For each candidate you reject, write the specific constraint in the scenario that rules it out.
  4. Record the surviving option and the residual risk it leaves — every choice leaves one, and naming it is what makes the recommendation honest.
  5. For the split-tunnel scenario, state explicitly what visibility you are trading away and which compensating controls buy it back.
  6. Build /tmp/decisions.csv as scenario,chosen,rejected,reason,residual_risk so the reasoning is checkable rather than asserted.

Verify

python3 - <<'PY'
import csv
rows=list(csv.DictReader(open('/tmp/decisions.csv')))
assert len(rows)>=5, 'fewer than five scenarios'
for r in rows:
    assert len(r['reason'].strip())>20, 'no reason given for '+r['scenario'][:30]
    assert len(r['residual_risk'].strip())>10, 'no residual risk for '+r['scenario'][:30]
    assert r['rejected'].strip(), 'nothing was eliminated for '+r['scenario'][:30]
chosen={r['chosen'].strip().lower() for r in rows}
print('distinct recommendations:',len(chosen))
assert len(chosen)>=4, 'the same answer for nearly every scenario - the constraints are not deciding'
PY
grep -ciE "visibility|inspect|compensat" /tmp/requirements.md

The last assertion is the important one. If four or five scenarios resolve to the same method, the constraints are not doing the work and you have chosen a favourite rather than reasoned from the requirement — which is precisely the error the exam's scenario questions are built to catch.

Notes

The residual risk column is what distinguishes a recommendation from a preference. Every one of these methods leaves something: full tunnel leaves a performance cost and a single choke point, ZTNA leaves the broker as a dependency, and split tunnel leaves the device bridging two networks.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.