A security architect is designing a DMZ for a web application that must communicate with a backend database. Which firewall rule set best represents defensible architecture?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because it restricts inbound traffic to HTTPS only, limits DMZ-to-DB communication to only the required port and specific IP, and prevents database-initiated connections back to the DMZ. A is wrong because allowing any from DMZ to DB is overly permissive.
Full explanation below image
Full Explanation
B is correct because it restricts inbound traffic to HTTPS only, limits DMZ-to-DB communication to only the required port and specific IP, and prevents database-initiated connections back to the DMZ. A is wrong because allowing any from DMZ to DB is overly permissive. C is wrong because allowing any traffic from the internet to the DMZ is dangerous. D is wrong because allowing all TCP from DMZ to DB provides excessive access.