ITPEC FE Morning April 2022 Question 44
There is a network that is divided into three (3) segments, namely an external segment, a DMZ, and an internal segment, by one (1) firewall. In this network, a service for users is published on the Internet using a system comprising a web server and a database server that contains critical data. Which of the following is the most appropriate server installation method for protecting critical data from unauthorized access via the Internet? Here, the web server performs front end processing for the database server, and the firewall allows only a specific protocol for communication between the external segment and the DMZ as well as between the DMZ and the internal segment. Direct communication between the external segment and the internal segment is not allowed.
Explanation
Web server in the DMZ, database server in the internal segment — the only server reachable from the Internet is the one that holds no critical data.
The firewall lets specific protocols through between the external segment and the DMZ and between the DMZ and the internal segment, but never directly from external to internal. With the web server in the DMZ, Internet users can reach the service, and the web server queries the database in the internal segment on their behalf. An attacker cannot reach the database directly, and even a compromised web server still faces the firewall, which passes only the database protocol.
Answer (c)
Why not others:
- •(a) — a database in the DMZ is reachable from the external segment, so the critical data sits one firewall rule away from the Internet
- •(b) — external to internal traffic is not allowed, so Internet users could not reach the web server and the service could not be published
- •(d) — the external segment lies outside the firewall, so the web server gets no protection, and the database in the DMZ is still reachable from the Internet
Key rule: Put in the DMZ only what must be reached from the Internet, and keep data stores in the internal segment, behind a second firewall boundary.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.