Question

A company hosts a public-facing web server that customers on the internet must reach, but the server also needs limited, controlled access to an internal database. Security policy requires that a compromise of the web server must NOT give an attacker direct access to the internal LAN. Which network design best satisfies these requirements?

Accepted Answer

Place the web server in a DMZ (screened subnet) between two firewall rule sets, allowing inbound web traffic and only specific database ports to the internal network

Answer

Place the web server directly on the internal LAN and open the necessary ports on the perimeter firewall

Answer

Place the web server outside the firewall on the public internet segment with no filtering

Answer

Place the web server on the internal LAN and rely on host-based antivirus to prevent lateral movement