ITPEC IP October 2023 Question 44

A file server that stores confidential information — only employees use it, so it belongs in the internal LAN behind the firewall, not in the DMZ.

The DMZ is a segment between the Internet and the internal LAN, separated from both by a firewall. It holds the servers that must be reachable from outside: the public web server, the mail server that receives external mail, and the DNS server for public names. If one of them is taken over, the firewall still blocks the attacker from the internal LAN. A file server needs no access from outside, and placing it in the DMZ would expose confidential data.

Answer (c)

Why not others:

• •(a) — a mail server that receives e-mail from outside must accept connections from the Internet, so it goes in the DMZ
• •(b) — a DNS server for public servers must answer queries from outside, so it goes in the DMZ
• •(d) — a web server that publishes to the outside must be reachable from the Internet, so it goes in the DMZ

Key rule: Put only the servers that must be reached from the Internet in the DMZ; everything used only internally stays on the internal LAN.

Security · AI-written, may contain errors