100-160 Question 81
Select 3A company is deploying a web application that needs to be accessible to external users over the internet. To ensure secure access and protect the internal network, they are designing a network security architecture. Which combination of components should the company implement in this scenario?
- A
Place the web application in a DMZ to isolate it from the internal network.
- B
Deploy an Intrusion Detection System (IDS) to monitor traffic to and from the web application.
- C
Use a honeypot in the internal network to distract attackers from the web application.
- D
Configure a proxy server to manage and filter requests coming to the web application.
- E
Host the web application directly on the internal network for faster performance.
Show answer and explanation
Correct answers: A, B, D
Explanation
A secure network architecture for a publicly accessible web application should include a DMZ to isolate the application, an IDS to monitor traffic, and a proxy server to manage and filter requests. These components collectively reduce the risk of intrusion and ensure robust security. Placing the application on the internal network or relying on a honeypot does not align with best practices for securing such services.
- A. Correct.
Placing the web application in a DMZ ensures that external users can access it while isolating it from the internal network, reducing the risk of compromise to internal systems. This is a standard practice for securing externally accessible services.
- B. Correct.
Deploying an IDS helps monitor traffic to and from the web application, allowing the detection of suspicious activity and potential security threats in real-time.
- C. Incorrect.
Although honeypots are useful for studying attacker behavior, deploying one in this scenario is unnecessary and does not directly contribute to securing the web application or protecting the internal network.
- D. Correct.
A proxy server can manage and filter incoming requests, ensuring only legitimate traffic reaches the web application. It can also provide caching and additional security measures.
- E. Incorrect.
Hosting the web application directly on the internal network introduces significant security risks. If the web application is compromised, attackers could potentially gain access to the internal systems.