CAS-001 · Question #317
A system administrator has installed a new Internet facing secure web application that consists of a Linux web server and Windows SQL server into a new corporate site. The administrator wants to…
The correct answer is B. Create an Internet zone, DMZ, and Internal zone on the firewall. Answer B (Internet zone, DMZ, and Internal zone) is correct because it follows the principle of defense in depth with appropriate zone separation: the Linux web server belongs in the DMZ (accessible from the internet but isolated from internal resources), while the Windows SQL…
Question
A system administrator has installed a new Internet facing secure web application that consists of a Linux web server and Windows SQL server into a new corporate site. The administrator wants to place the servers in the most logical network security zones and implement the appropriate security controls. Which of the following scenarios BEST accomplishes this goal?
Options
- ACreate an Internet zone, DMZ, and Internal zone on the firewall.
- BCreate an Internet zone, DMZ, and Internal zone on the firewall.
- CCreate an Internet zone and two DMZ zones on the firewall.
- DCreate an Internet zone and two DMZ zones on the firewall.
How the community answered
(30 responses)- A3% (1)
- B73% (22)
- C7% (2)
- D17% (5)
Explanation
Answer B (Internet zone, DMZ, and Internal zone) is correct because it follows the principle of defense in depth with appropriate zone separation: the Linux web server belongs in the DMZ (accessible from the internet but isolated from internal resources), while the Windows SQL Server belongs in the Internal zone (never directly internet-facing, only accessible from the DMZ web tier). This three-zone model is the industry-standard architecture for internet-facing web applications with backend databases. The two-DMZ approach (Answers C/D) would place the database in a secondary DMZ, which still exposes it to more risk than the fully internal zone provides, and violates the principle that databases containing sensitive data should never be in any perimeter-facing zone.
Topics
Community Discussion
No community discussion yet for this question.