ISC2 CC Network Security Practice Question
An organization wants to segment its network so that public-facing servers are isolated from internal users. Which network design component should be used?
⚠ Common exam trap
The trap is confusing DMZ with VLAN; candidates think any network segmentation equals a DMZ, but a VLAN alone does not create the internet-facing, firewalled isolation a DMZ provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DMZ
A DMZ (demilitarized zone) is a perimeter subnetwork that hosts public-facing services such as web, mail, and DNS servers while keeping them separated from the internal trusted network. Traffic from the internet reaches the DMZ, but the DMZ is firewalled off from the internal LAN, so a compromised public server cannot pivot directly into internal systems. This is the standard architecture for isolating externally accessible servers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Honeypot
Why it's wrong here
A honeypot is a decoy system that lures and observes attackers; it does not segment or isolate traffic. The option tempts because honeypots sit in public-facing environments, but actual segmentation requires a firewall, DMZ, or VLAN, which enforce traffic boundaries.
- ✗
Subnet
Why it's wrong here
A subnet partitions IP address space but does not itself enforce isolation between public-facing servers and internal users; routing between subnets is permitted by default. Subnetting is correct when you need to organise addressing or reduce broadcast scope, not to apply security boundaries.
- ✓
DMZ
Why this is correct
A DMZ is a screened subnet placed between the internal network and the internet, hosting public-facing servers while enforcing firewall rules that block inbound traffic from reaching internal users. This directly satisfies the requirement to isolate public-facing servers from the internal network.
- ✗
VLAN
Why it's wrong here
A VLAN segments traffic logically at Layer 2 within one subnet, so it cannot isolate public-facing servers from internal users across different IP ranges. It is tempting because VLANs do separate broadcast domains, and would be correct for dividing departments on shared physical switches.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Security Foundations
Key term
DMZ
A DMZ (demilitarized zone) is a network segment that sits between an internal private network and the public internet, hosting publicly accessible services while keeping the internal network isolated.
Key term
Standard
A standard is an agreed-upon set of rules, guidelines, or specifications that ensure consistency, compatibility, and quality across IT products, services, and processes.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.