Examkin

Question

Difficulty: EasySecure Network Design and Segmentation

An enterprise security administrator needs to isolate public-facing web servers from the internal corporate network to ensure that external internet traffic cannot directly reach internal database servers. Which network design boundary should the administrator implement to host these public services?

  1. Demilitarized zone (DMZ)Answer
  2. B
    Air-gapped network segment
  3. C
    Implicitly trusted intranet segment
  4. D
    Production honeynet environment

Answer

Demilitarized zone (DMZ)
A demilitarized zone (DMZ) is a specialized physical or logical subnetwork that exposes an organization's external-facing services to an untrusted network, such as the internet, while keeping the rest of the enterprise network isolated. If a server in the DMZ is compromised, the internal firewall controls limit the attacker's ability to pivot into the internal network.

Step-by-Step Solution

1
Identify the architectural requirement
Public-facing services (web servers) need to be accessible from the internet while preventing direct access to sensitive internal resources.
Security best practices dictate separating publicly reachable assets from internal private assets.
2
Evaluate network segmentation options
A demilitarized zone (DMZ) creates a perimeter subnet placed between the untrusted external network (internet) and the trusted internal network.
Firewall rules control North-South traffic into the DMZ and strictly restrict East-West traffic from the DMZ into the internal network.

Key Concept

Demilitarized Zone (DMZ) Perimeter Design
Estimated Time:45s
Rate this question

Topics

Secure Network Design and Segmentation

More questions from this topic