CISSP Communication and Network Security Practice Question
A company is designing a network segmentation strategy to isolate a public-facing web server from the internal corporate network. Which of the following is the most appropriate architecture?
⚠ Common exam trap
Many exam-takers confuse VLANs with security boundaries, assuming a VLAN alone provides sufficient isolation, when in fact VLANs lack access control and are vulnerable to Layer 2 attacks, making a DMZ with firewalls the correct answer for network segmentation of public-facing services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DMZ (screened subnet)
A DMZ (screened subnet) is the most appropriate architecture because it places the public-facing web server in a separate, isolated network segment that sits between the internal corporate network and the untrusted internet. Traffic from the internet is allowed only to the DMZ (typically via stateful firewall rules permitting HTTP/HTTPS on TCP ports 80/443), and traffic from the DMZ to the internal network is strictly controlled or proxied, preventing direct lateral movement. This aligns with the principle of defense in depth and is a standard CISSP-recommended design for securing publicly accessible services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Micro-segmentation using SDN
Why it's wrong here
Micro-segmentation using Software-Defined Networking (SDN) provides extremely granular network segmentation, often down to individual workloads, enforcing zero-trust principles. While highly effective for internal network security and lateral movement prevention, it represents a more complex and potentially overkill solution for the specific problem of securely hosting externally accessible services. A dedicated Demilitarized Zone (DMZ) is the standard, purpose-built, and more straightforward architectural pattern for this common requirement.
- ✗
VLAN with no firewall
Why it's wrong here
Virtual Local Area Networks (VLANs) provide logical separation of network devices at Layer 2, segmenting broadcast domains and improving network efficiency. However, VLANs alone do not offer any security policy enforcement, traffic inspection, or access control between segments or to the internet. Without a firewall, traffic can traverse between VLANs (if routed) or directly from external sources, leaving the network vulnerable to attacks without any protective barrier.
- ✗
Direct connection to internet without segmentation
Why it's wrong here
Directly connecting an internal network to the internet without any form of segmentation is an extremely high-risk and fundamentally insecure approach. This configuration exposes all internal systems, applications, and sensitive data to direct attacks, reconnaissance, and unauthorized access from the public internet. It completely bypasses essential security principles like defense-in-depth and perimeter protection, making the entire network a single, highly vulnerable attack surface.
- ✓
DMZ (screened subnet)
Why this is correct
A Demilitarized Zone (DMZ), also known as a screened subnet, is a dedicated network segment specifically designed to host public-facing services that require external accessibility, such as web servers, email servers, or DNS servers. It acts as a buffer zone, typically situated between two firewalls, isolating these public services from the more sensitive internal network. This architecture ensures that even if a server within the DMZ is compromised, attackers still face another security layer before gaining access to internal resources, significantly enhancing overall network security.
Visual reference
Go deeper
Related to this question
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.