mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A security architect is designing a new DMZ for…
A security architect is designing a new DMZ for an e-commerce platform. The DMZ must host a web server, an API gateway, and a database server. The architect needs to minimize the attack surface while ensuring the web server can communicate with the API gateway, and the API gateway can communicate with the database. Which network segmentation approach best meets these requirements?
⚠ Common exam trap
CompTIA often tests the misconception that placing the database server on the internal network (Option C) is acceptable, but in a DMZ design, any server that must be accessed from a DMZ should remain in the DMZ to avoid exposing internal network resources to potential compromise.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create three separate DMZ subnets: one for the web server, one for the API gateway, and one for the database server, with firewall rules allowing only required traffic.
It implements the principle of least privilege through network segmentation. By placing each service in its own DMZ subnet with firewall rules that allow only the required traffic (e.g., HTTP/HTTPS from web to API, SQL from API to database), the attack surface is minimized. This prevents lateral movement if one service is compromised, as an attacker cannot directly reach the database from the web server or the API gateway from the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place all three services in the same DMZ subnet and use host-based firewalls to restrict traffic.
Why it's wrong here
Host-based firewalls can be misconfigured or bypassed; a single subnet does not provide network-level isolation.
- ✗
Create two DMZ subnets: one for the web server and API gateway, and another for the database server.
Why it's wrong here
The web server and API gateway share a subnet, allowing unnecessary direct access from web to database if the API gateway is compromised.
- ✗
Place the web server in a DMZ subnet, the API gateway in a separate DMZ subnet, and the database server on the internal network.
Why it's wrong here
Placing the database on the internal network exposes it to internal threats and complicates firewall rules for encrypted traffic.
- ✓
Create three separate DMZ subnets: one for the web server, one for the API gateway, and one for the database server, with firewall rules allowing only required traffic.
Why this is correct
This provides defense in depth; each tier is isolated, and only specific ports/protocols are allowed between them.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.