What should be the limitation for inbound Internet traffic in a DMZ?

What should be the limitation for inbound Internet traffic in a DMZ?

• A. It should be unrestricted
• B. Only from specified IP addresses
• C. From all public IP addresses
• D. Only from trusted networks

Answer: (B)

In a Demilitarized Zone (DMZ), the limitation for inbound Internet traffic should ideally be from specified IP addresses. This configuration enhances security by tightly controlling which external entities can interact with resources hosted in the DMZ. By allowing only traffic from pre-defined, trusted IP addresses, the organization can mitigate the risk of attacks, unauthorized access, and exposure to vulnerabilities. This approach aligns with best practices in network defense, where limiting exposure to known, reliable sources reduces the attack surface and allows for better monitoring and incident response. In a DMZ, which often houses public-facing services, this tactic helps secure sensitive services from undesirable traffic, thereby providing a barrier between external threats and internal networks. Configuring the DMZ to accept traffic only from specified IP addresses serves as an additional layer of security, as it implies that legitimate users are identified and authorized beforehand, thereby minimizing the potential for misuse or exploitation by attackers coming from the broader internet.

In a Demilitarized Zone (DMZ), the limitation for inbound Internet traffic should ideally be from specified IP addresses. This configuration enhances security by tightly controlling which external entities can interact with resources hosted in the DMZ. By allowing only traffic from pre-defined, trusted IP addresses, the organization can mitigate the risk of attacks, unauthorized access, and exposure to vulnerabilities.

This approach aligns with best practices in network defense, where limiting exposure to known, reliable sources reduces the attack surface and allows for better monitoring and incident response. In a DMZ, which often houses public-facing services, this tactic helps secure sensitive services from undesirable traffic, thereby providing a barrier between external threats and internal networks.

Configuring the DMZ to accept traffic only from specified IP addresses serves as an additional layer of security, as it implies that legitimate users are identified and authorized beforehand, thereby minimizing the potential for misuse or exploitation by attackers coming from the broader internet.