ISC2 CC Network Security Practice Question
A financial services firm is designing a network that must allow inbound HTTPS from the internet to a public web application while preventing any direct inbound connections to its internal database servers. The security architect proposes placing the web application in a screened subnet and configuring rules so the database can be reached only from the web application. Which design element is the architect primarily relying on?
⚠ Common exam trap
The trap here is believing that address translation or a perimeter firewall alone creates an internal security boundary, when zone separation and inter-zone rules are what actually restrict access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A demilitarized zone (DMZ) with controlled access between zones
The architect needs a screened subnet for the public web application plus enforced rules controlling traffic between the internet, the DMZ, and internal systems. A DMZ with controlled access accomplishes this by allowing inbound HTTPS to the web tier while denying direct inbound access to database servers. A flat network, NAT alone, or a hub topology lacks the required separation and rule enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A hub-based network topology
Why it's wrong here
A hub repeats traffic to all connected devices, which exposes communications and provides no traffic separation or access control. It cannot enforce which systems may reach the database servers. Using hubs would worsen both security and performance, and it does not implement the screened subnet and controlled inter-zone rules the scenario requires.
- ✓
A demilitarized zone (DMZ) with controlled access between zones
Why this is correct
A DMZ hosts public-facing services in a screened subnet separate from internal systems, and firewall rules control traffic between the DMZ, the internet, and the internal network. This allows inbound HTTPS to the web application while preventing direct inbound access to database servers. The controlled inter-zone rules are the core of the design.
- ✗
A flat network with a single perimeter firewall
Why it's wrong here
A flat network places public and internal systems in the same broadcast domain, so a compromise of the web application could more easily reach database servers. A single perimeter firewall does not provide the internal separation needed to prevent direct inbound connections to the database. This design increases risk rather than satisfying the stated requirement.
- ✗
Network address translation (NAT) alone
Why it's wrong here
NAT translates addresses and can hide internal addressing, but it is not a security boundary by itself. It does not inherently prevent a compromised public web server from reaching database servers if routing and rules permit it. Relying on NAT alone would not enforce the controlled access between the public service and the internal database.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Security Foundations
Key term
NAT
NAT (Network Address Translation) is a method that allows multiple devices on a private network to share a single public IP address when accessing the internet.
Key term
Hypertext Transfer Protocol Secure
Hypertext Transfer Protocol Secure, or HTTPS, is the secure version of HTTP that encrypts data between a web browser and a website using SSL/TLS to protect sensitive information like passwords and credit card numbers.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.