What is a Screened Subnet (DMZ) used for in network security?

What is a Screened Subnet (DMZ) used for in network security?

• A. Internal resources
• B. DMZ contains hosts that offer public services
• C. Honeypot network
• D. VPN gateway

Answer: (B)

A Screened Subnet, or DMZ, is a buffer zone in front of an internal network that hosts public-facing services. The idea is to place servers that must be reachable from the internet—such as web, mail, or DNS servers—in a separate subnet that is protected by firewalls on both sides. This way, external traffic is filtered before it can reach the internal network, and any compromise of a DMZ host is less likely to give an attacker access to sensitive internal resources. So the best fit is that the DMZ contains hosts that offer public services. The other options aren’t the primary purpose: internal resources live behind the inner firewall, a honeypot network is a decoy system meant to attract attackers rather than serve legitimate public functions, and while a VPN gateway could be placed in or near a DMZ, the main role of a DMZ is hosting publicly accessible services, not remote-access termination.

A Screened Subnet, or DMZ, is a buffer zone in front of an internal network that hosts public-facing services. The idea is to place servers that must be reachable from the internet—such as web, mail, or DNS servers—in a separate subnet that is protected by firewalls on both sides. This way, external traffic is filtered before it can reach the internal network, and any compromise of a DMZ host is less likely to give an attacker access to sensitive internal resources.

So the best fit is that the DMZ contains hosts that offer public services. The other options aren’t the primary purpose: internal resources live behind the inner firewall, a honeypot network is a decoy system meant to attract attackers rather than serve legitimate public functions, and while a VPN gateway could be placed in or near a DMZ, the main role of a DMZ is hosting publicly accessible services, not remote-access termination.