Which of the following statements about DMZ are true? Each correct answer represents a complete solution. Choose two.

A DMZ (Demilitarized Zone) is by definition the boundary segment positioned between the untrusted internet and a trusted private internal network. It serves as a controlled buffer zone where traffic from external networks is regulated by firewalls on both sides. This architecture separates public-facing exposure from the sensitive internal corporate environment.

A DMZ is a network architecture segment, not anti-virus software - it does not scan traffic for malware or perform any content inspection itself.

The primary purpose of a DMZ is to host company resources that must be publicly accessible from the internet, such as web servers, FTP servers, DNS servers, and email gateways. These services are placed in the DMZ rather than the internal network so external users can reach them without gaining direct access to sensitive internal systems. This design limits the damage if a public-facing server is compromised.

While ACLs are often configured on devices that border a DMZ, an ACL is not a defining or required characteristic of the DMZ architecture itself.