CISSP Communication and Network Security Practice Question
An organization is implementing network segmentation. They need to place publicly accessible servers (e.g., web and email) in a separate network that is isolated from the internal LAN but still allows controlled access from the internet. Which architecture should they use?
⚠ Common exam trap
Many exam-takers confuse VLANs with DMZs, assuming that a VLAN alone provides security isolation from the internet, when in fact VLANs only segment Layer 2 traffic and require additional firewall rules to control access—unlike a DMZ which is specifically designed for public-facing servers with explicit security policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DMZ
A DMZ (demilitarized zone) is a network segment that sits between the internet and the internal LAN, hosting publicly accessible servers like web and email. It uses firewall rules to allow inbound traffic from the internet to the DMZ servers while blocking direct access to the internal network, and typically permits only specific outbound responses or updates from the DMZ to the internal LAN. This architecture provides the isolation and controlled access required by the scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DMZ
Why this is correct
A Demilitarized Zone (DMZ) is a perimeter network designed to host public-facing services, such as web servers or email servers, that need to be accessible from the internet while protecting the internal private network. It acts as a buffer zone, typically secured by two firewalls, allowing controlled inbound and outbound traffic to specific services without exposing the internal LAN directly to external threats. This architecture provides a critical layer of security by isolating public assets from the internal network.
- ✗
Micro-segmentation
Why it's wrong here
Micro-segmentation controls east-west traffic between workloads inside a data centre using software-defined policies, but it does not create a physically or logically isolated perimeter network for internet-facing servers. The stem requires a DMZ architecture that separates public servers from the internal LAN while permitting controlled inbound traffic. Micro-segmentation is tempting because it enforces granular access controls between application tiers, and it would be correct for limiting lateral movement within a private cloud environment, not for isolating external-facing services from an internal network.
- ✗
VPN
Why it's wrong here
A Virtual Private Network (VPN) primarily establishes secure, encrypted connections over an untrusted network, like the internet, to provide remote users or branch offices with secure access to internal resources. While VPNs enhance confidentiality and integrity for data in transit, they do not inherently provide network segmentation for public-facing servers or isolate them from an internal network. Their function is secure connectivity, not architectural isolation of public services from the LAN.
- ✗
VLAN
Why it's wrong here
A Virtual Local Area Network (VLAN) logically segments a single physical network into multiple broadcast domains at Layer 2, improving network performance and security by separating traffic. However, VLANs alone do not provide the robust security architecture required to isolate public-facing servers from an internal network with controlled internet access. While a DMZ might utilize VLANs for internal segmentation within its zone, a VLAN itself does not establish the necessary perimeter defense and firewall-based access controls for internet-exposed services.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.