County IT is standing up public-facing proxies for the permits portal. Where should those proxies be placed in the virtual network design?
Select an answer to reveal the explanation.
Short Explanation
Public proxies belong in a DMZ the way a front desk sits between the street and the records vault—not in the vault itself. A dedicated DMZ subnet keeps citizen-facing permits proxies away from internal app and data tiers. Parking them next to the database or on elections VLANs mixes trust zones you do not want mixed.
Full Explanation
Public-facing proxies for a county permits portal belong in a dedicated DMZ subnet that is intentionally separated from internal application and data tiers. In virtual-network design, the DMZ is the controlled landing zone for internet-reachable components: inbound citizen traffic terminates there first, and only narrowly allowed paths continue toward internal services. Placing permits proxies in that zone reduces blast radius if a public endpoint is exploited, because compromise starts in a segment that is already treated as higher exposure and is firewalled away from databases and internal application backends.
Collocating proxies on the same subnet as the internal permits database with no isolation fails because a public compromise then shares Layer-3 adjacency with authoritative data, eliminating the buffer that DMZ architecture exists to provide. Hosting citizen access on staff laptops using consumer VPN profiles fails on concept and operations: staff endpoints are not a stable, governed edge for public portals, and consumer VPN patterns do not implement municipal ingress controls, certificates, or capacity management. Placing proxies inside the elections tabulation VLAN fails because elections systems are high-sensitivity and often tightly air-gapped or default-deny; reusing that addressing for public permits traffic mixes unrelated trust domains and expands elections exposure.
Exam caveat: a DMZ does not mean "no security" or "flat open subnet." Proxies still need hardening, TLS, and restrictive egress to internal tiers. The distinguishing design choice in this item is placement relative to internal data—dedicated DMZ versus collocation with sensitive segments.
Operational check: confirm proxies have addresses only in the DMZ range, route tables and firewalls allow only required proxy-to-app or proxy-to-API flows, database listeners are unreachable directly from the internet path, and elections or other high-sensitivity VLANs show no permits-proxy adjacency in diagrams or live rules.