An engineer is tasked with deploying an internal perimeter firewall that will support multiple DMZs Each DMZ has a unique private IP subnet range. How is this requirement satisfied?

Question

Options

• ADeploy the firewall in transparent mode with access control policies.
• BDeploy the firewall in routed mode with access control policies.
• CDeploy the firewall in routed mode with NAT configured.
• DDeploy the firewall in transparent mode with NAT configured.

• A
  2% (1)
• B
  93% (39)
• C
  2% (1)
• D
  2% (1)

Explanation

Since each DMZ has a unique private IP subnet, the firewall must operate at Layer 3 and perform IP routing between those subnets. Routed mode (the standard firewall deployment mode) assigns IP addresses to each interface and routes traffic between them - this is precisely what is needed to separate and connect multiple DMZs with distinct subnet ranges. Access control policies then define permitted traffic flows between zones. Transparent mode operates at Layer 2 (like a bridge or switch) and does not route between IP subnets - it is designed to be inserted inline without changing the IP addressing scheme. NAT is not required here since all DMZs use private IP ranges and internal routing is sufficient.

No community discussion yet for this question.