N10-009 Question 282
Single answerZones: Trusted vs. untrusted, Screened subnetA company hosts a public web application and an external DNS server for customers. The security team wants to reduce risk to the internal corporate LAN if either public-facing server is compromised. They have a next-generation firewall that supports multiple security zones. Which design best meets this requirement?
- A
Place the web and DNS servers on the trusted internal LAN and allow inbound Internet traffic only to the required ports
- B
Place the web and DNS servers on an untrusted Internet segment so they are separated from the firewall and internal LAN
- C
Place the web and DNS servers in a screened subnet between the Internet and the trusted internal LAN, with tightly controlled rules to and from the internal network
- D
Place the web server in the trusted zone and the DNS server in the untrusted zone so that at least one service remains isolated
Show answer and explanation
Correct answer: C
Explanation
The best answer is to use a screened subnet, also called a DMZ, for systems that must be accessible from untrusted networks. In Network+ terms, the trusted zone contains internal corporate devices and resources, while the untrusted zone represents external networks such as the Internet. A screened subnet sits between them and is used for public-facing services like web, email relay, reverse proxy, and external DNS. This design follows common security architecture guidance, including the principle of least privilege and network segmentation best practices published by organizations such as NIST. The firewall should enforce narrowly scoped rules: allow only necessary inbound traffic from the untrusted zone to the screened subnet, and only explicitly approved traffic from the screened subnet to the trusted zone. This reduces the likelihood that compromise of a public server will lead directly to compromise of internal systems.
- A. Incorrect.
This is incorrect because putting public-facing systems directly on the trusted internal LAN increases risk. Even if the firewall limits inbound ports, a compromise of the web or DNS server could provide an attacker with a foothold inside the trusted network. Best practice is to separate Internet-accessible services from internal user and server networks.
- B. Incorrect.
This is incorrect because the untrusted zone typically represents the external network, such as the Internet, and is not where an organization would normally place its own protected public servers. If these systems are effectively on the outside of the firewall, the organization loses the benefit of controlled segmentation and security policy enforcement between those servers and external threats.
- C. Correct.
This is correct because a screened subnet, commonly implemented as a DMZ, is specifically designed to host public-facing services while isolating them from the trusted internal LAN. In this model, the firewall enforces separate policies between the untrusted zone and the screened subnet, and between the screened subnet and the trusted zone. This limits lateral movement if a public server is compromised and allows only specific required traffic to internal resources.
- D. Incorrect.
This is incorrect because placing the web server in the trusted zone still exposes the internal LAN to unnecessary risk. The DNS server being in an untrusted zone does not solve the core problem of protecting internal systems from compromise of public-facing hosts. Mixing public services across trusted and untrusted zones is not a sound screened subnet design.