Architects are redesigning how the city's public website reaches the Internet so a compromise of that host cannot freely traverse into internal finance systems. Which network pattern best supports that goal?

A screened subnet—commonly called a DMZ—places the city’s public website in an intermediate network zone. Firewalls control untrusted ingress from the Internet and enforce carefully limited access toward internal finance systems, often through application proxies rather than flat trust. If the citizen-facing host is compromised, attackers still face an additional choke point instead of unrestricted reach to file shares and databases. That pattern directly supports the architects’ redesign goal.

Putting the public web server on the same VLAN as finance file shares collapses trust boundaries and lets a web foothold speak locally to sensitive systems. Disabling all firewalls between the website and the internal LAN for performance removes the controls the redesign exists to provide. Publishing finance databases on the same public IP as the website extends direct Internet exposure to back-end data stores.

Exam caveat: DMZ hosts must still be patched, hardened, and monitored; a screened subnet is architecture, not a substitute for host security. East-west rules should be least privilege—specific ports to brokers—not any-any “temporary” permits that become permanent.

Operational check: migrate the site into DMZ addressing, replace broad internal allows with explicit application flows, verify from a test foothold on the web tier that finance VLANs are unreachable except via approved paths, and alert on anomalous DMZ-to-internal connection attempts.