The city needs a public web presence and a protected finance network. Which zoning approach best reduces attack surface?
Select an answer to reveal the explanation.
Short Explanation
Public storefront in the front room, money in the back vault—with a lock between them. DMZ for the web face, internal zone for finance. Flat networks and finance-in-the-DMZ are how attackers get a shorter walk.
Full Explanation
Zoning reduces attack surface by putting systems of different trust and exposure in different network segments with controlled transit. Public web services belong in a DMZ or screened subnet that can accept Internet traffic under tight firewall rules, while finance systems remain on a more trusted internal zone without direct Internet exposure. East-west and north-south flows between the DMZ and finance should be minimize-and-allow-list rather than flat connectivity. Security+ network architecture repeatedly tests this pattern: Internet-facing presentation tiers are screened; high-value data stays inward.
Placing public web and finance on one flat VLAN maximizes lateral movement after any web compromise. Putting finance databases in the DMZ next to public web servers for faster queries exposes crown-jewel data to the zone most likely to be probed. Removing all firewalls between zones so applications can "discover each other freely" abandons segmentation entirely.
Exam caveat: DMZ-for-public, internal-for-sensitive is the durable answer pattern; finance-in-DMZ and flat networks are common wrong choices. Operationally, enforce deny-by-default between zones, allow only required ports from web tier to app/data tiers, keep admin paths off the public VIP, log interzone denies, and review rules when new integrations threaten to punch standing holes into finance.