312-39 · Question #1
The SOC team is tasked with enhancing the security of an organization's network infrastructure. The organization's public-facing web servers, which handle customer transactions, need to be isolated…
The correct answer is A. Demilitarized Zone (DMZ). A DMZ is the standard architecture component used to place internet-facing services (web, mail relays, reverse proxies) into a separate, controlled network segment that sits between the untrusted internet and the trusted internal network. From a SOC perspective, the DMZ reduces…
Question
The SOC team is tasked with enhancing the security of an organization's network infrastructure. The organization's public-facing web servers, which handle customer transactions, need to be isolated from the internal private network containing sensitive employee data and proprietary systems. The goal is to create a buffer zone that limits exposure of internal systems if the web servers are compromised during a cyberattack, such as a DDoS or SQL injection attempt. As a SOC analyst, which network architecture component would you recommend implementing to establish this isolated region?
Options
- ADemilitarized Zone (DMZ)
- BIntrusion Detection System (IDS)
- CFirewall
- DHoneypot
How the community answered
(60 responses)- A73% (44)
- B7% (4)
- C3% (2)
- D17% (10)
Explanation
A DMZ is the standard architecture component used to place internet-facing services (web, mail relays, reverse proxies) into a separate, controlled network segment that sits between the untrusted internet and the trusted internal network. From a SOC perspective, the DMZ reduces the impact of compromise by limiting lateral movement opportunities. Even if a web server is exploited (SQL injection, remote code execution, credential theft), the attacker is confined to a segment with strict, minimal access rules into internal systems. This is achieved by enforcing tightly scoped inbound and outbound traffic policies at the DMZ boundaries, typically allowing only necessary ports and explicitly approved flows (for example, web tier to app tier on a specific port, with no direct route to employee data networks). A firewall is a control that enforces policy, but the “isolated region/buffer zone” concept is specifically the DMZ. IDS and honeypots are detection/deception controls; they do not provide the segmentation boundary required to isolate public-facing systems from sensitive internal networks.
Topics
Community Discussion
No community discussion yet for this question.