mediumMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: A network administrator is configuring a DMZ for…
A network administrator is configuring a DMZ for a company's web and email servers. Which firewall rule is most appropriate for traffic from the internet to the DMZ?
⚠ Common exam trap
ISC2 often tests the misconception that a DMZ should allow only web traffic (HTTP/HTTPS) and forget that email servers require SMTP and DNS, leading candidates to choose option C instead of the more complete option B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Allow inbound HTTP, HTTPS, SMTP, and DNS to DMZ
A DMZ must selectively permit essential services from the internet to the public-facing servers while blocking all other inbound traffic. HTTP (80), HTTPS (443), SMTP (25), and DNS (53) are the standard protocols required for web and email servers to function. This rule implements the principle of least privilege by allowing only the necessary traffic to the DMZ.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deny all inbound traffic to DMZ but allow outbound
Why it's wrong here
This would prevent external users from accessing the servers.
- ✓
Allow inbound HTTP, HTTPS, SMTP, and DNS to DMZ
Why this is correct
These are the required services for web and email servers.
- ✗
Allow inbound only to the web server on ports 80 and 443
Why it's wrong here
This does not allow email traffic (SMTP, POP3) to the email server.
- ✗
Allow all inbound traffic to DMZ
Why it's wrong here
Allowing all inbound traffic defeats the purpose of a DMZ.
Go deeper
Related to this question
Learn chapter
Network Security Foundations
Key term
DNS
DNS is the system that translates human-friendly domain names like example.com into machine-readable IP addresses so computers can find each other on a network.
Key term
DMZ
A DMZ (demilitarized zone) is a network segment that sits between an internal private network and the public internet, hosting publicly accessible services while keeping the internal network isolated.
About these practice questions
Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.