A security architect is designing a multi-tier web application network layout for a corporate enterprise. The design requires that public Internet users can access the front-end web servers, but direct connectivity from the Internet to the backend database servers holding sensitive payment data must be strictly prohibited. Furthermore, administrative access to the database tier must be tightly restricted and audited, with lateral East-West movement between unauthorized server segments blocked. Which of the following network architecture designs best achieves this security objective?
- Place web servers in a perimeter screened subnet (DMZ) and isolate database servers in a restricted internal network segment, enforcing access control lists and requiring administrative transit through a dedicated jump server.Answer
- BDeploy a robust edge perimeter firewall to filter all external incoming traffic while allowing unrestricted internal traffic routing between the web server tier and database tier.
- CCombine the public web servers, database infrastructure, and internal management systems into a single flattened VLAN to simplify network routing and administrative maintenance.
- DPosition an inline honeypot system between the web tier and database tier to filter malicious SQL queries and block lateral intrusion attempts in real time.
Answer
Placing public-facing web servers in a screened subnet (DMZ), placing backend databases in isolated internal network segments, and restricting management access via jump boxes best protects sensitive assets from direct external access and lateral threat movement.
Placing public-facing services in a screened subnet (DMZ) isolates external exposure. Combining this with internal subnetting/VLAN isolation for database tiers and restricting administrative access to a jump server enforces effective defense-in-depth and controls lateral movement.
Step-by-Step Solution
Key Concept
Network Segmentation, Screened Subnets (DMZ), and Bastion/Jump Server Architecture