What is a DMZ in network security?
D3 · Architecture · CompTIA Security+ SY0-701A DMZ (Demilitarized Zone) is a network segment that sits between the public internet and the internal private network, hosting public-facing services (web servers, email servers, DNS) that need to be accessible from the internet without exposing the internal network.
Architecture: Internet → Firewall 1 → DMZ (web/mail servers) → Firewall 2 → Internal network.
If a DMZ server is compromised, the attacker still faces the inner firewall before reaching internal systems.
Architecture: Internet → Firewall 1 → DMZ (web/mail servers) → Firewall 2 → Internal network.
If a DMZ server is compromised, the attacker still faces the inner firewall before reaching internal systems.
The DMZ is a key defense architecture concept. Servers in the DMZ are exposed to the internet but isolated from internal systems. Bastion host = a hardened server in the DMZ. The dual-firewall DMZ is more secure than a single-firewall tri-homed design.