A security engineer is designing a DMZ for a public-facing web application. Which firewall rule policy best follows defense-in-depth principles?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because blocking direct DMZ-to-internal traffic and routing database calls through an application proxy limits the blast radius if the DMZ is compromised. A is wrong because allowing all outbound from the DMZ defeats the purpose of the DMZ architecture.
Full explanation below image
Full Explanation
B is correct because blocking direct DMZ-to-internal traffic and routing database calls through an application proxy limits the blast radius if the DMZ is compromised. A is wrong because allowing all outbound from the DMZ defeats the purpose of the DMZ architecture. C is wrong because permitting direct database access without stateful inspection gives attackers a direct path to sensitive data. D is wrong because placing the database in the DMZ exposes it directly to the internet.