Inbound Internet traffic should be limited to IP addresses within the DMZ. Which option reflects this rule?

Inbound Internet traffic should be limited to IP addresses within the DMZ. Which option reflects this rule?

• A. Block all inbound traffic
• B. Inbound Internet traffic should be limited to IP addresses within the DMZ
• C. Inbound Internet traffic should be limited to internal network addresses
• D. Inbound Internet traffic should be allowed from any external IP

Answer: (B)

Exposing only the DMZ to inbound Internet traffic is the safe way to provide needed public access while protecting the internal network. The DMZ acts as a buffer zone where public-facing services (like a web or mail server) live. By restricting inbound connections from the Internet to the DMZ’s IP addresses, you ensure external clients can reach only those publicly exposed hosts and cannot directly reach machines inside the internal network. This setup allows you to tightly control and monitor traffic to the DMZ (opening only the necessary ports like 80/443) and keep internal resources isolated behind additional firewall barriers. Choosing to block all inbound traffic would prevent legitimate access to DMZ services. Allowing inbound traffic to internal network addresses would defeat the purpose of the DMZ by permitting direct access to internal resources from the Internet. Allowing inbound traffic from any external IP is insecure and broadens exposure. The DMZ-focused rule provides the right balance of accessibility and protection.

Exposing only the DMZ to inbound Internet traffic is the safe way to provide needed public access while protecting the internal network. The DMZ acts as a buffer zone where public-facing services (like a web or mail server) live. By restricting inbound connections from the Internet to the DMZ’s IP addresses, you ensure external clients can reach only those publicly exposed hosts and cannot directly reach machines inside the internal network. This setup allows you to tightly control and monitor traffic to the DMZ (opening only the necessary ports like 80/443) and keep internal resources isolated behind additional firewall barriers.

Choosing to block all inbound traffic would prevent legitimate access to DMZ services. Allowing inbound traffic to internal network addresses would defeat the purpose of the DMZ by permitting direct access to internal resources from the Internet. Allowing inbound traffic from any external IP is insecure and broadens exposure. The DMZ-focused rule provides the right balance of accessibility and protection.