nerdexam
CompTIA

CAS-002 · Question #271

A system administrator has installed a new Internet facing secure web application that consists of a Linux web server and Windows SQL server into a new corporate site. The administrator wants to…

The correct answer is B. Create an Internet zone, DMZ, and Internal zone on the firewall. For a web application with a public-facing web server and a backend database, the standard defense-in-depth architecture uses a DMZ for the web tier and an internal zone for the database tier.

Technical Integration of Enterprise Components

Question

A system administrator has installed a new Internet facing secure web application that consists of a Linux web server and Windows SQL server into a new corporate site. The administrator wants to place the servers in the most logical network security zones and implement the appropriate security controls. Which of the following scenarios BEST accomplishes this goal?

Options

  • ACreate an Internet zone, DMZ, and Internal zone on the firewall.
  • BCreate an Internet zone, DMZ, and Internal zone on the firewall.
  • CCreate an Internet zone and two DMZ zones on the firewall.
  • DCreate an Internet zone and two DMZ zones on the firewall.

How the community answered

(20 responses)
  • A
    15% (3)
  • B
    75% (15)
  • C
    5% (1)
  • D
    5% (1)

Why each option

For a web application with a public-facing web server and a backend database, the standard defense-in-depth architecture uses a DMZ for the web tier and an internal zone for the database tier.

ACreate an Internet zone, DMZ, and Internal zone on the firewall.

This choice represents the same zone labels as B but implies a server placement that does not optimally isolate the SQL server from the Internet-facing tier.

BCreate an Internet zone, DMZ, and Internal zone on the firewall.Correct

Creating Internet, DMZ, and Internal zones on the firewall is the standard three-tier architecture where the Linux web server resides in the DMZ and the Windows SQL server is protected in the internal zone. This prevents direct Internet access to the database and requires all traffic to traverse firewall rule sets at each boundary. This segmentation contains breach impact and aligns with the principle of placing sensitive data stores behind the most restrictive firewall boundary.

CCreate an Internet zone and two DMZ zones on the firewall.

Using two DMZ zones places both the web server and SQL server in semi-trusted zones without a fully protected internal segment for the database, reducing SQL server protection.

DCreate an Internet zone and two DMZ zones on the firewall.

Two DMZ zones still expose the SQL server to a less-protected segment than a dedicated internal zone, violating least-privilege network segmentation principles.

Concept tested: DMZ and internal zone placement for web applications

Source: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-firewalls/98966-dmz-config.html

Topics

#DMZ#network segmentation#firewall zones#web server security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice