mediumMultiple Choice
DMZ Security Architecture Best Practices
An organization is redesigning its DMZ to host a public web server and an internal file server. Which architecture provides the strongest security?
Quick Answer
Placing the web server in the DMZ while keeping the file server on the internal network, and restricting the path between them to only HTTP/HTTPS, provides the strongest security because it applies two complementary principles at once: least privilege and defense in depth. The DMZ exists specifically to host systems that must be reachable from the internet, isolating them in a buffer zone so that a compromise of the internet-facing service doesn't automatically expose the rest of the internal network. Keeping the file server internal, rather than also placing it in the DMZ, removes it from direct external exposure entirely; the only way to reach it is through the narrow, controlled channel of HTTP/HTTPS traffic originating from the web server, typically enforced by a stateful firewall or application-layer gateway. This matters because if the web server is ever compromised, the attacker inherits only the limited HTTP/HTTPS access the firewall permits, not full network-level reach into the internal file server, which sharply reduces the blast radius and makes lateral movement much harder. A weaker design, such as placing both servers in the DMZ or allowing broad connectivity between them, would let a single compromised system become a launchpad into everything else. When a question asks you to compare DMZ architectures, favor the option that minimizes both what's exposed externally and what a compromised DMZ host can reach internally.
⚠ Common exam trap
Many candidates assume placing both servers in the DMZ (Option A) is simpler and sufficient, but they overlook that the DMZ is a semi-trusted zone and internal servers should never be directly exposed to the internet or to compromised DMZ hosts without strict access controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the web server in the DMZ and the file server on the internal network; allow only HTTP/HTTPS from web server to file server.
It follows the principle of least privilege and defense in depth by placing the public-facing web server in the DMZ, where it can be accessed from the internet, while the internal file server remains on the internal network, isolated from direct external access. Only HTTP/HTTPS traffic is allowed from the web server to the file server, typically enforced by a stateful firewall or an application-layer gateway, which minimizes the attack surface and prevents lateral movement if the web server is compromised.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place both servers in the DMZ with no firewall between them.
Why it's wrong here
Co-locating both servers in one DMZ segment leaves no firewall boundary between the internet-facing web server and the internal file server, so a web compromise reaches file data directly. Segmentation with distinct subnets and rules is required. A single flat DMZ suits only servers of identical trust level.
- ✗
Place the web server on the internal network and the file server in the DMZ with a VPN.
Why it's wrong here
Placing the web server internally exposes the internal network if it is compromised, and a VPN does not make the file server safe in a DMZ. It tempts because VPNs encrypt traffic, but the architecture still puts the publicly reachable host behind the internal boundary.
- ✗
Place both servers on the internal network with a stateful firewall inspecting traffic.
Why it's wrong here
Placing the public web server on the internal network exposes the trusted zone to internet traffic, relying solely on one stateful firewall rather than DMZ isolation. The file server belongs internally, but the web server must sit in a separate screened subnet so compromise cannot pivot inward.
- ✓
Place the web server in the DMZ and the file server on the internal network; allow only HTTP/HTTPS from web server to file server.
Why this is correct
Segregating the public web server into the DMZ while keeping the file server internal satisfies the requirement to protect internal data. Restricting traffic to HTTP/HTTPS only prevents the web tier from reaching the file server over other protocols, limiting lateral movement if it is compromised.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer is designing a DMZ to host public-facing services. Which two security best practices should be applied? (Choose two.)
easy- A.Use the same firewall rule set for DMZ and internal network
- B.Place web servers on the internal network
- C.Enable full mesh connectivity between DMZ hosts
- ✓ D.Use a screened subnet with two firewalls
- ✓ E.Allow inbound traffic from internet to DMZ on required ports only
Why D: Option D is correct because a screened subnet architecture with two firewalls (an external firewall facing the internet and an internal firewall facing the trusted network) creates defense in depth, so if a DMZ host is compromised the attacker still must breach a second firewall to reach internal systems. Option E is correct because DMZ hosts should be reachable only on the specific ports their public services require (for example TCP 443 for HTTPS), enforcing least privilege and minimizing the attack surface exposed to the internet. Option A is wrong because applying the same rule set to the DMZ and internal network defeats segmentation and would let DMZ compromises pivot freely into the internal LAN. Option B is wrong because placing public-facing web servers on the internal network exposes trusted systems directly to internet-facing risk instead of isolating them in the DMZ. Option C is wrong because full mesh connectivity between DMZ hosts enables lateral movement after a single host is compromised, whereas DMZ hosts should be isolated from one another unless a specific service dependency requires otherwise.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.