ISC2 CC Network Security Practice Question
An organization is planning to deploy a DMZ to host web and email servers accessible from the internet. Which three security best practices should be implemented for the DMZ? (Choose three.)
⚠ Common exam trap
The trap here is that candidates pick 'single firewall' because it sounds simpler and cheaper, but CompTIA and security exams consistently reward defense-in-depth with separate firewall boundaries between trust zones.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a separate VLAN for DMZ servers to isolate traffic
Option C is correct because placing DMZ servers on a dedicated VLAN segments their broadcast domain and Layer 2 traffic from the internal LAN, so a compromised web or email host cannot directly reach internal systems at Layer 2 and lateral movement is constrained. Option D is correct because a dual-firewall (screened subnet) design puts one firewall between the internet and the DMZ and a second between the DMZ and the internal network, enforcing defense in depth so that even if a DMZ host is compromised, the internal firewall still blocks access to internal resources. Option E is correct because strict access control rules implementing least privilege—permitting only the specific ports and protocols required (for example, TCP 80/443 to the web server and TCP 25/587 to the mail server)—minimize the attack surface and prevent unnecessary services from being reachable. Option A is not correct because a single firewall with three interfaces, while workable, does not provide the layered separation and defense in depth that a dual-firewall DMZ design offers. Option B is not correct because allowing all traffic from the DMZ to the internal network violates least privilege and would let a compromised DMZ host pivot freely into the internal network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a single firewall to connect internet, DMZ, and internal network
Why it's wrong here
A single firewall creates a shared failure and policy domain, so a compromise in the DMZ can pivot to the internal network. It is tempting for cost and simplicity, and would be acceptable only where no internet-facing services require segregation from internal assets.
- ✗
Allow all traffic from the DMZ to the internal network for ease of management
Why it's wrong here
Permitting unrestricted DMZ-to-internal traffic lets a compromised web or email host pivot directly into the internal network, defeating the DMZ's segmentation purpose. It is tempting because permissive rules reduce troubleshooting effort, but a DMZ should allow only specific, brokered flows from internal to DMZ, never the reverse.
- ✓
Use a separate VLAN for DMZ servers to isolate traffic
Why this is correct
A dedicated VLAN segments DMZ broadcast domains from internal LAN traffic, so compromise of a public-facing server cannot sniff or directly reach internal hosts at layer 2. This isolation satisfies the requirement to contain any breach originating from internet-accessible servers.
- ✓
Place a firewall between the internet and the DMZ, and another between the DMZ and the internal network
Why this is correct
Two firewalls create a screened subnet: the outer firewall filters internet traffic, while the inner firewall enforces a second boundary, preventing a compromised DMZ host from reaching the internal network directly. This layered filtering satisfies the requirement to protect internal systems from internet-facing servers.
- ✓
Configure strict access control rules to allow only necessary services
Why this is correct
Strict access control rules restrict DMZ traffic to only the ports and protocols each public service requires, denying everything else. This least-privilege filtering limits the attack surface exposed by internet-accessible web and email servers, satisfying the requirement to harden the DMZ.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Security Foundations
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.