A regional bank hires your company to perform a security assessment on their network after a recent data breach. The attacker was able to steal financial data from the bank by compromising only a sing

A DMZ (demilitarized zone) is a network segment separated from the internal network by an additional firewall boundary, isolating externally reachable servers from systems holding sensitive data. By placing the front-end web server in the DMZ, an attacker who compromises it is still blocked from the internal financial systems by that boundary, directly addressing the architectural flaw where one server breach exposed all financial data.

Replacing anti-virus software does not address the root cause - the absence of network segmentation - that allowed a single compromised server to reach financial data.

Moving financial data to another server on the same IP subnet provides no additional protection because the attacker already had access to that subnet through the initially compromised server.

Issuing new certificates improves authentication and encryption of communications but does not fix the lack of network segmentation that permitted lateral movement to financial data.