CISSP Communication and Network Security Practice Question
An organization is implementing network segmentation to enhance security. They create a DMZ to host public-facing servers and want to ensure that if a server is compromised, the attacker cannot pivot to the internal network. Which firewall placement best achieves this?
⚠ Common exam trap
Many exam-takers assume a single firewall with a DMZ interface (three-legged firewall) provides sufficient isolation, but without a second firewall or strict egress filtering, the DMZ can still be used as a pivot point to the internal network.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a screened subnet with two firewalls: one between internet and DMZ, and one between DMZ and internal network
A screened subnet architecture uses two firewalls to create a DMZ that is logically isolated from both the internet and the internal network. The first firewall (internet-facing) controls inbound traffic to the DMZ, while the second firewall (internal-facing) strictly controls outbound traffic from the DMZ to the internal network, typically allowing only specific return traffic. This prevents an attacker who compromises a DMZ server from directly initiating connections to internal hosts, as the internal firewall would block such traffic unless explicitly permitted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place the DMZ on the internal network side with a strong host-based firewall on each server
Why it's wrong here
Placing the DMZ directly on the internal network side fundamentally undermines the concept of a demilitarized zone. The primary purpose of a DMZ is to create an isolated buffer zone for public-facing services, preventing direct access to the internal network. Even with strong host-based firewalls, a compromise of a DMZ server would grant an attacker a foothold *within* the internal network perimeter, significantly increasing the attack surface and risk to sensitive internal resources.
- ✗
Place a single firewall between the internet and the DMZ, and allow traffic from DMZ to internal network
Why it's wrong here
A single firewall between the internet and the DMZ, configured to permit traffic from the DMZ to the internal network, creates a critical security vulnerability. If a server within the DMZ is compromised, an attacker could then leverage that compromised server to initiate connections directly into the internal network, bypassing any further perimeter defenses. This configuration fails to provide the necessary defense-in-depth to protect internal assets from a DMZ breach.
- ✗
Use a stateful firewall that only allows return traffic from internal to DMZ
Why it's wrong here
Configuring a stateful firewall to *only* allow return traffic from internal to DMZ is overly restrictive and impractical for most operational needs, as it prevents internal users from initiating legitimate connections to DMZ services. Furthermore, while it aims to restrict DMZ-initiated traffic, a sophisticated attacker could potentially exploit existing internal-to-DMZ connections or misconfigurations to establish a session, then leverage the "return traffic" rule to exfiltrate data or maintain persistence from a compromised DMZ server back into the internal network.
- ✓
Implement a screened subnet with two firewalls: one between internet and DMZ, and one between DMZ and internal network
Why this is correct
Implementing a screened subnet architecture with two firewalls is the industry-standard and most robust method for DMZ deployment. The first firewall isolates the DMZ from the internet, while the second firewall strictly controls traffic between the DMZ and the internal network. This design provides defense-in-depth, ensuring that even if a DMZ server is compromised, the attacker still faces a second, dedicated firewall before gaining access to sensitive internal resources, significantly limiting the blast radius of a breach.
Visual reference
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.