Which types of hosts may be placed in the DMZ?

• A. Eternal DNS servers
• B. Public webservers
• C. Both A and B
• D. Neither A nor B

Answer: (C)

A DMZ serves as a buffer zone where services that must be reachable from the internet live, while keeping your internal network protected. Public-facing hosts like web servers and DNS servers fit this role well because they need to be accessible from anywhere on the internet. Placing them in the DMZ allows you to apply strict firewall rules and isolate them from the internal network, so even if one of these hosts is compromised, the attacker has limited access to internal systems.

Public web servers need to answer requests from users across the internet, and DNS servers must respond to external queries. Both types benefit from being in a DMZ because you can expose only the necessary ports and services to the outside world, while blocking unnecessary internal access. The DMZ typically sits between external and internal firewalls, allowing controlled traffic from the internet to the DMZ and from the DMZ to the internet, with restricted paths to the internal network.

Internal resources, such as databases or sensitive applications, are generally kept behind the internal firewall and not directly exposed in the DMZ. This layered approach helps prevent attackers who compromise DMZ hosts from reaching critical internal assets.