You need to deploy a new web-based software package for your organization. The package requires three separate servers and needs to be available on the Internet. What is the recommended architecture…

Placing all three servers entirely on the internal network would make the web application unreachable from Internet users, defeating the requirement that it be publicly available.

Placing only the web server in the DMZ or Internet-facing zone limits the attack surface to a single tier that handles only presentation logic. The application server on the internal network processes business logic without being directly reachable from external attackers. The database server, which holds sensitive data, is further isolated on the internal network, accessible only from the application server through tightly controlled firewall rules.

Exposing the database server directly to the Internet is a critical security misconfiguration that would allow attackers to attempt direct connections to the most sensitive tier of the application.

Placing all three servers on the Internet unnecessarily exposes the application and database tiers to direct external attacks, violating the principle of defense-in-depth and least exposure.