A public web server for city hall must be reachable from the internet and must not sit on the internal LAN with the staff computers. Where should the server be placed?
Select an answer to reveal the explanation.
Short Explanation
A screened subnet is a front parlor that visitors can enter without getting the run of the house. You put the city-hall web server there, between firewalls, so the internet can reach it and it does not sit on the internal LAN. Beside the staff machines, on the guest wireless, or outside with no policy, the server is not in that parlor.
Full Explanation
A screened subnet sits between an outer firewall facing the internet and an inner firewall facing the trusted LAN. The public web server goes there. The outer policy allows the internet to reach the web service, and the inner policy keeps that server off the staff LAN. Placing it on the internal LAN punches inbound holes into the network the requirement says it must not join. The guest wireless network is for visitors. It is not a controlled home for the city site, and visitor devices would share its fate. Putting the server on the outside, in front of the outer firewall, does make it reachable, and there is then no policy between the internet and the server. That skips the screen. Exam caveat: the screened subnet still needs tight rules. Allow the web ports inbound, and do not let the server open broad connections into the LAN. Operational check: from the internet, confirm the site loads, and read both firewall policies to verify the server's subnet is neither the outside nor the inside.