Question

A company hosts a public-facing web server that must be reachable from the internet but also needs to query an internal database server that stores customer records. The security architect wants to minimize the risk that a compromise of the web server leads directly to exposure of the database. Which device placement approach BEST addresses this requirement?

Accepted Answer

Place the web server in a screened subnet (DMZ) and keep the database server on the internal network, allowing only specific ports between them

Answer

Place both the web server and database server in the same screened subnet to simplify connectivity

Answer

Place the web server directly on the internal network and rely on host-based firewalls to filter traffic

Answer

Place the database server in the screened subnet and keep the web server internal, exposing it through a reverse proxy