ITPEC FE Morning October 2020 Question 42
There is a network that is divided into three (3) segments (i.e., external segment, DMZ, and internal segment) by one (1) firewall. In this network, a service for users is to be made available over the Internet by using a system comprising a web server and a database server containing important data. Which of the following is the most appropriate method of server installation that can protect important data from unauthorized access from the Internet? Here, only a specific protocol is allowed for communications between the external segment and the DMZ, and between the DMZ and the internal segment by the firewall. Direct communication between the external segment and the internal segment is not allowed.
Explanation
Web server in the DMZ, database server in the internal segment — the only server reachable from the Internet is the one that holds no important data.
The firewall lets specific protocols through between the external segment and the DMZ and between the DMZ and the internal segment, but never directly from external to internal. With the web server in the DMZ, Internet users can reach the service, and the web server queries the database in the internal segment on their behalf. An attacker cannot reach the database directly, and even a compromised web server still faces the firewall, which passes only the database protocol.
Answer (c)
Why not others:
- •(a) — traffic from the external segment to the internal segment is not allowed, so Internet users could not reach a web server placed there and the service could not be offered
- •(b) — the DMZ accepts traffic from the external segment, so the important data would sit one firewall rule away from the Internet, and a compromised web server beside it would reach the database with no firewall in between
- •(d) — the external segment lies outside the firewall, so the web server gets no protection, and the database in the DMZ is still reachable from the Internet
Key rule: Put in the DMZ only what must be reached from the Internet, and keep data stores in the internal segment, behind a second firewall boundary.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.