A network engineer is concerned about hosting web SFTP. and email services m a single DMZ that is hosted in the same security zone. This could potentially allow lateral movement within the…

Question

Options

• APut all the services on a single host to reduce the number of servers
• BCreate separate security zones for each service and use ACLs for segmentation
• CKeep the web server in the DMZ and move the other server services to the internal network
• DDeploy a switch and create VLANs for each service

• B
  80% (12)
• C
  13% (2)
• D
  7% (1)

Explanation

The core problem is that placing web, SFTP, and email servers in the same security zone means a compromise of any one service gives an attacker unrestricted lateral movement to the others. The correct mitigation is to place each service in its own dedicated security zone and enforce ACLs (Access Control Lists) between those zones, so only explicitly permitted traffic can flow. This is the principle of micro-segmentation applied to the DMZ. Option A (consolidate onto one host) makes the problem dramatically worse - a single compromise yields all services and eliminates even OS-level isolation. Option C (move services to the internal network) defeats the purpose of the DMZ, which is to keep public-facing services away from internal resources, and would expose the internal network to Internet threats. Option D (deploy VLANs) provides Layer 2 segmentation but without enforcing security policy at Layer 3/4 with ACLs or firewall rules, lateral movement between VLANs remains easy.

No community discussion yet for this question.