nerdexam
CompTIA

SY0-501 · Question #241

A security administrator is configuring a new network segment, which contains devices that will be accessed by external users, such as web and FTP server. Which of the following represents the MOST…

The correct answer is D. The segment should be placed on an extranet, and the firewall rules should be configured to. To securely configure a network segment containing external-facing web and FTP servers, it should be placed in an extranet or DMZ, with appropriate firewall rules.

Submitted by brentm· Mar 4, 2026Security architecture

Question

A security administrator is configuring a new network segment, which contains devices that will be accessed by external users, such as web and FTP server. Which of the following represents the MOST secure way to configure the new network segment?

Options

  • AThe segment should be placed on a separate VLAN, and the firewall rules should be
  • BThe segment should be placed in the existing internal VLAN to allow internal traffic only.
  • CThe segment should be placed on an intranet, and the firewall rules should be configured to
  • DThe segment should be placed on an extranet, and the firewall rules should be configured to

How the community answered

(47 responses)
  • A
    4% (2)
  • B
    13% (6)
  • C
    6% (3)
  • D
    77% (36)

Why each option

To securely configure a network segment containing external-facing web and FTP servers, it should be placed in an extranet or DMZ, with appropriate firewall rules.

AThe segment should be placed on a separate VLAN, and the firewall rules should be

While placing the segment on a separate VLAN provides logical isolation, it does not fully describe the most secure architectural pattern for external-facing services like a dedicated extranet/DMZ.

BThe segment should be placed in the existing internal VLAN to allow internal traffic only.
CThe segment should be placed on an intranet, and the firewall rules should be configured to
DThe segment should be placed on an extranet, and the firewall rules should be configured toCorrect

Placing the segment on an extranet, which typically refers to a demilitarized zone (DMZ) in this context, is the most secure approach for servers accessed by external users. An extranet/DMZ isolates these public-facing services from the internal network, allowing strict firewall rules to control all inbound and outbound traffic, thereby minimizing the attack surface on internal resources.

Concept tested: Secure network segmentation with DMZ/Extranet

Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/network-best-practices#implement-a-perimeter-network-dmz

Topics

#DMZ#network segmentation#firewall configuration#perimeter security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SY0-501 Practice