CND (312-38) Network Defense Simulation

Master the implementation of secure network perimeters. This simulation tests your ability to architect, analyze, and enforce Demilitarized Zone (DMZ) concepts to protect internal networks from external threats.

Network Scenario

Your organization is redesigning its network perimeter to host a new customer-facing web application and email gateway. The Chief Information Security Officer (CISO) emphasizes a strict "Defense-in-Depth" strategy.

You have been tasked with reviewing the proposed firewall access control lists (ACLs) and ensuring the architectural definition of the newly created subnetwork strictly adheres to enterprise DMZ best practices. You must verify that the environment properly segregates public-facing assets from the highly sensitive internal Local Area Network (LAN).

Traffic & Logs

[FW-EDGE-01] Perimeter Access Control List Review
-------------------------------------------------
Rule 10: PERMIT TCP ANY -> DMZ_SUBNET EQ 443
Rule 20: PERMIT TCP ANY -> DMZ_SUBNET EQ 80
Rule 30: PERMIT TCP LAN_SUBNET -> DMZ_SUBNET ANY
Rule 40: DENY IP DMZ_SUBNET -> LAN_SUBNET ANY   <-- Security Control Focus
Rule 50: PERMIT IP LAN_SUBNET -> ANY
Rule 99: DENY IP ANY -> ANY (Implicit Deny)

Question

Which of the following statements are TRUE about Demilitarized zone (DMZ)?

Each correct answer represents a complete solution. Choose all that apply.

Expert Analysis

1. What is happening in the network: Defenders are establishing a perimeter buffer zone. They are placing systems that require internet exposure (web servers, mail relays) into a segregated subnet to prevent direct access to internal resources from the outside world.

2. Identify attack or behavior: Public-facing servers are highly susceptible to exploitation (e.g., OWASP Top 10 web vulnerabilities). If an attacker compromises a server in the DMZ, their next goal is lateral movement.

3. Why correct answers are correct (A, B, C): These statements perfectly define a DMZ. It acts as an isolation layer (C), physically or logically separated from the LAN to expose external services (B), while keeping the primary internal network and its computers securely behind the firewall (A).

4. Why the other statement is wrong (D): Hosts in the DMZ should never have "full connectivity" to hosts in the internal network. Traffic originating from the DMZ to the LAN should be explicitly denied by default (as seen in Rule 40). If a DMZ server needs to query an internal database, a specific, highly restrictive pinhole rule must be created for only that exact port and destination.

5. Defensive action: Implement strict egress filtering on the DMZ interface. Ensure the firewall drops all unestablished connections attempting to route from the DMZ subnetwork into the LAN subnetwork.

MINI LESSON: DMZ Architecture Types

Single Firewall (Three-Legged Model): One firewall with at least three network interfaces: External (Internet), Internal (LAN), and DMZ.
Dual Firewall (Back-to-Back): The most secure model. Uses two firewalls. The first firewall allows traffic from the internet to the DMZ. The second firewall sits between the DMZ and the LAN, applying even stricter policies.

Explore more CND simulations