A regional bank hires your company to perform a security assessment on their network after a recent data breach. The attacker was able to steal financial data from the bank by compromising only a sing

A DMZ (demilitarized zone) is a network segment that separates public-facing servers from the internal network containing sensitive data. By placing the front-end web server in a DMZ, even if an attacker fully compromises it, they cannot directly reach the internal financial database servers without breaching an additional firewall layer. This directly addresses the root cause - a flat network where one compromised host could access all data.

Replacing anti-virus software does not address the architectural weakness of a flat network and would not prevent lateral movement after an initial server compromise.

Moving financial data to another server on the same IP subnet provides no additional isolation, as an attacker who compromised the original server would have the same level of access to any host in the same subnet.

Issuing new certificates addresses transport-layer authentication and encryption but does not segment the network or prevent an attacker from accessing other servers after an initial compromise.