CAS-002 · Question #350
Company XYZ is building a new customer facing website which must access some corporate resources. The company already has an internal facing web server and a separate server supporting an extranet…
The correct answer is B. Dedicated DMZ network segments. Publicly accessible servers should be isolated in dedicated DMZ segments to prevent lateral movement into internal networks while still allowing external access.
Question
Company XYZ is building a new customer facing website which must access some corporate resources. The company already has an internal facing web server and a separate server supporting an extranet to which suppliers have access. The extranet web server is located in a network DMZ. The internal website is hosted on a laptop on the internal corporate network. The internal network does not restrict traffic between any internal hosts. Which of the following locations will BEST secure both the intranet and the customer facing website?
Options
- AThe existing internal network segment
- BDedicated DMZ network segments
- CThe existing extranet network segment
- DA third-party web hosting company
How the community answered
(54 responses)- A2% (1)
- B93% (50)
- C4% (2)
- D2% (1)
Why each option
Publicly accessible servers should be isolated in dedicated DMZ segments to prevent lateral movement into internal networks while still allowing external access.
Placing the customer-facing website on the internal network exposes corporate resources directly to external threats, eliminating any meaningful perimeter separation.
Dedicated DMZ network segments enforce segmentation between the public-facing customer website and the internal corporate network, ensuring that a compromise of the customer site cannot directly reach internal resources. Each server type gets its own DMZ segment, limiting the blast radius of any breach. This follows defense-in-depth principles by placing untrusted-facing services in controlled perimeter zones.
The existing extranet segment already hosts supplier-facing services, and co-locating the customer site there creates unnecessary risk by mixing two distinct trust boundaries.
Third-party hosting shifts operational control away from the company but does not inherently address the architectural requirement to secure both sites relative to each other and to internal resources.
Concept tested: Network DMZ segmentation for multi-tier web architecture
Source: https://www.nist.gov/publications/guidelines-firewalls-and-firewall-policy
Topics
Community Discussion
No community discussion yet for this question.