The DMZ
The three zones (Internet, DMZ, internal network), which servers go in the DMZ, the flows allowed and forbidden between zones and the two possible setups: a three-legged firewall or two firewalls in series.
- 19 cards
- 6 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- On the diagram
- Scenarios
- Understand
A few cards from the deck
DMZ: what is it?
Show the answer
A buffer zone that holds the servers reachable from the Internet, separated from the internal network by filtering.
If an exposed server is compromised, the attacker stays in the buffer zone and does not directly reach the internal machines or data.
The DMZ web server is compromised. Which rule limits the damage the most?
- Forbid the DMZ from opening connections to the internal network, except specific flows
- Allow all ports from the DMZ to the internal database for updates
- Allow the DMZ to reach the internal machines to push fixes to them
- Let the DMZ reach the directory to authenticate the site's users
Show the answer
Forbid the DMZ from opening connections to the internal network, except specific flows
If the DMZ can reach the inside, the buffer zone is useless. When a flow is needed, for example to the database, it is allowed on a single port and from a single machine.
In a DMZ, flows from the … to the DMZ are limited to a few ports, and flows from the DMZ to the … network are refused except for precise exceptions.
Show the answer
In a DMZ, flows from the Internet to the DMZ are limited to a few ports, and flows from the DMZ to the internal network are refused except for precise exceptions.
The essential rule is the direction: a DMZ server must not be able to start a connection toward the inside, otherwise its compromise opens up the network.
Trust zone: what is it?
Show the answer
A part of a network grouping machines with the same level of exposure and sensitivity, subject to the same filtering rules.
The level of trust depends on exposure: the Internet has none, the DMZ little, the internal network the most. Flows go freely only toward a less trusted zone.