easyMultiple ChoiceObjective-mapped
CAS-004 Practice Question: During a security assessment, it is discovered…
During a security assessment, it is discovered that an organization's DMZ hosts can initiate outbound connections to the internal network. Which architectural change would best mitigate the risk of a DMZ compromise spreading to the internal network?
⚠ Common exam trap
The CAS-004 exam often tests the misconception that adding more security features (like IPS or IP allowlists) to an existing architecture is sufficient, when the real solution requires a fundamental change in traffic flow direction (unidirectional vs. bidirectional) to eliminate the attack vector entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the DMZ firewall to block all outbound connections from DMZ to the internal network, and use a reverse proxy for inbound services
The most effective way to prevent a compromised DMZ host from pivoting into the internal network is to enforce a unidirectional traffic flow. By blocking all outbound connections from the DMZ to the internal network at the firewall and using a reverse proxy (e.g., HAProxy, Nginx, or Apache with mod_proxy) to handle inbound requests, the DMZ hosts never directly initiate connections to internal resources. This eliminates the lateral movement path even if a DMZ host is fully compromised, as the reverse proxy terminates the external connection and forwards requests to internal servers without allowing the DMZ host to establish a new outbound session.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allow only specific IPs in the DMZ to connect to internal servers
Why it's wrong here
This reduces attack surface but still allows some connections, which is risky.
- ✗
Replace the DMZ firewall with a next-generation firewall that includes IPS
Why it's wrong here
NGFW with IPS can detect threats but does not prevent outbound connections from DMZ to internal.
- ✓
Configure the DMZ firewall to block all outbound connections from DMZ to the internal network, and use a reverse proxy for inbound services
Why this is correct
This ensures that DMZ hosts cannot be used as a pivot point into the internal network.
- ✗
Move all DMZ services to a cloud provider and use a site-to-site VPN
Why it's wrong here
Moving to cloud does not solve the architectural issue; a VPN would still allow connectivity.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.