CND (312-38) Network Defense Simulation
Network Scenario
Your organization is redesigning its network perimeter to host a new public-facing web application. To separate the public-facing servers from the internal corporate network, you need to implement a Demilitarized Zone (DMZ). The security architect has mandated the use of a single hardware security appliance to enforce strict access controls between the Internet, the DMZ, and the Internal LAN, minimizing hardware costs while maintaining strict segmentation.
Traffic & Logs
You are reviewing the configuration of the proposed perimeter security appliance. The interface mapping and basic zone policies are displayed below:
Logical interface Zone IP Address Status
----------------------------------------------------------
eth1/1 (Outside) UNTRUST 198.51.100.22/29 UP
eth1/2 (Inside) TRUST 10.10.0.1/16 UP
eth1/3 (DMZ) DMZ 172.16.50.1/24 UP
Admin@FW-Core-01> show running-config security-policies
Rule 1: UNTRUST -> DMZ (Allow HTTP/HTTPS)
Rule 2: TRUST -> DMZ (Allow SSH, RDP)
Rule 3: TRUST -> UNTRUST (Allow outbound internet)
Rule 4: DMZ -> TRUST (DENY ALL)
Analysis Note: Notice how a single device is managing routing and access control for three entirely separate subnets with differing trust levels.
Question
Which type of firewall consists of three interfaces and allows further subdivision of the systems based on specific security objectives of the organization?
Expert Analysis
1. What is happening in the network: The organization is implementing network segmentation using a single firewall appliance to manage three distinct trust zones: The untrusted public internet, the semi-trusted DMZ, and the highly trusted internal network.
2. Identify attack or behavior: By segmenting the network, defenders are proactively mitigating lateral movement. If an attacker compromises a public-facing web server in the DMZ, Rule 4 (DMZ -> TRUST: DENY ALL) prevents them from pivoting into the internal network.
3. Why correct answer is correct: Multi-homed firewall is the correct architectural term for a firewall equipped with three or more network interfaces. Each interface connects to a separate network segment (in this case: Outside, Inside, and DMZ), allowing granular policy enforcement and subdivision based on organizational security objectives.
4. Why others are wrong:
- Screened subnet: While this architecture *creates* a DMZ, it typically uses *two* separate firewalls (an external and an internal firewall) sandwiching the DMZ, rather than a single three-interface appliance.
- Bastion host: This is a heavily fortified server exposed to a public network (often placed inside a DMZ), not the firewall architecture itself.
- Unscreened subnet: This refers to a basic setup where the internal network is connected to the internet through a router with no DMZ implementation at all.
5. Defensive action: Ensure strictly enforced zero-trust rules from the DMZ to the internal network. Only allow highly specific, stateful return traffic, and log all dropped packets from the DMZ interface to monitor for pivot attempts.
- Dual-Homed: A firewall with two interfaces (Inside and Outside). Limited segmentation capabilities.
- Multi-Homed: A firewall with three or more interfaces. Enables the creation of a DMZ on a dedicated port.
- Screened Subnet: Uses two distinct firewalls to physically isolate the DMZ from both the internet and the internal LAN, providing defense-in-depth in case one firewall fails.
Ready for more challenges?
Explore more CND simulations