CyberCertPrepNetwork FundamentalsNetwork DevicesEASYFree question
What is a DMZ (demilitarized zone) in network architecture, and which device type enforces the security boundary between the DMZ, the internet, and the internal network?
- A.A DMZ is an older term for a load balancer cluster positioned in front of web servers
- B.A DMZ is a VLAN dedicated to guest Wi-Fi users; its boundary is enforced by the wireless controller
- C.A DMZ is enforced by a Layer 2 switch using VLANs without routing; no firewall is needed between segments
- D.A DMZ is an isolated network segment between two firewall interfaces that hosts internet-facing services (web, email, DNS); a firewall with at least three interfaces enforces rules: internet traffic can reach DMZ hosts, but DMZ hosts cannot initiate connections to the internal LAN
Why D is correct
A DMZ is a semi-trusted zone where internet-facing servers reside. A three-interface firewall has: WAN (untrusted), DMZ (semi-trusted), and LAN (trusted). Rules typically permit: internet to DMZ on specific ports; LAN to DMZ on specific ports; and block DMZ-initiated traffic to LAN. A two-firewall DMZ design adds a second firewall between DMZ and LAN. Options B, C, D misdefine DMZ.
Know someone studying for Network Fundamentals? Send them this one.