ISC2 CC Network Security Practice Question
An organization is planning to deploy a DMZ to host web and email servers accessible from the internet. Which three security best practices should be implemented for the DMZ? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a separate VLAN for DMZ servers to isolate traffic
Firewalls on both sides, strict access rules, and separate VLANs are best practices. Direct internal access and single firewall are not recommended.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a single firewall to connect internet, DMZ, and internal network
Why it's wrong here
A single firewall may not provide sufficient separation.
- ✗
Allow all traffic from the DMZ to the internal network for ease of management
Why it's wrong here
This would expose internal network to risk.
- ✓
Use a separate VLAN for DMZ servers to isolate traffic
Why this is correct
VLAN segmentation adds another layer of isolation.
- ✓
Place a firewall between the internet and the DMZ, and another between the DMZ and the internal network
Why this is correct
Two firewalls provide defense in depth.
- ✓
Configure strict access control rules to allow only necessary services
Why this is correct
Minimize exposure by permitting only required ports/protocols.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
DMZ
A DMZ (demilitarized zone) is a network segment that sits between an internal private network and the public internet, hosting publicly accessible services while keeping the internal network isolated.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
One of 976 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.