DMZ architecture in Cybersecurity - Mini Project: Build & Apply

Understanding DMZ Architecture

📖 Scenario: You are working as a network security assistant helping to design a safe network layout for a small company. The company wants to protect its internal network while allowing public access to its web server.

🎯 Goal: Build a simple representation of a DMZ (Demilitarized Zone) architecture using a dictionary to show different network zones and their purposes.

📋 What You'll Learn

Create a dictionary named network_zones with exact keys and values representing zones and their descriptions

Add a variable named public_zone to specify which zone is accessible to the public

Use a loop with variables zone and description to iterate over network_zones.items()

Add a final key-value pair to network_zones representing the firewall with its description

💡 Why This Matters

🌍 Real World

Understanding DMZ architecture helps protect company networks by separating public servers from internal systems, reducing security risks.

💼 Career

Network security professionals design and manage DMZs to safeguard sensitive data and ensure safe access to public services.

1

Create the initial network zones dictionary

Create a dictionary called network_zones with these exact entries: 'Internal Network': 'Trusted zone for company devices', 'DMZ': 'Semi-trusted zone for public servers', 'External Network': 'Untrusted internet zone'.

Cybersecurity

# Create the network_zones dictionary with specified zones and descriptions
# Your code here

Hint

Use curly braces {} to create a dictionary and separate each key-value pair with commas.

2

Add a variable for the public accessible zone

Add a variable called public_zone and set it to the string 'DMZ' to indicate which zone is accessible to the public.

Cybersecurity

network_zones = {
    'Internal Network': 'Trusted zone for company devices',
    'DMZ': 'Semi-trusted zone for public servers',
    'External Network': 'Untrusted internet zone'
}
# Define the public_zone variable
# Your code here

Hint

Assign the string 'DMZ' to the variable public_zone.

3

Iterate over the network zones to review descriptions

Use a for loop with variables zone and description to iterate over network_zones.items(). Inside the loop, write a comment explaining that this would be where you check or display each zone's description.

Cybersecurity

network_zones = {
    'Internal Network': 'Trusted zone for company devices',
    'DMZ': 'Semi-trusted zone for public servers',
    'External Network': 'Untrusted internet zone'
}
public_zone = 'DMZ'

# Loop through network_zones to access each zone and its description
# Your code here

Hint

Use for zone, description in network_zones.items(): to loop through the dictionary.

4

Add the firewall zone to the network zones dictionary

Add a new key-value pair to the network_zones dictionary with the key 'Firewall' and the value 'Controls traffic between zones'.

Cybersecurity

network_zones = {
    'Internal Network': 'Trusted zone for company devices',
    'DMZ': 'Semi-trusted zone for public servers',
    'External Network': 'Untrusted internet zone'
}
public_zone = 'DMZ'

for zone, description in network_zones.items():
    # Here you could check or display the zone and its description
    pass

# Add the firewall zone to network_zones
# Your code here

Hint

Add the new key and value to the dictionary using square brackets and assignment.

Practice

1. What is the main purpose of a DMZ (Demilitarized Zone) in network security?

easy

A. To store backup data securely

B. To speed up internet connection for all users

C. To replace firewalls in a network

D. To separate and protect the internal network from external threats

Solution

1. Step 1: Understand the role of DMZ

   A DMZ is a special network area that acts as a buffer between the internet and the internal network.

2. Step 2: Identify its main function

   It hosts public services like websites while protecting the private internal network from outside threats.

3. Final Answer:

   To separate and protect the internal network from external threats -> Option D

4. Quick Check:

   DMZ protects internal network = C [OK]

Hint: DMZ acts as a buffer zone between internet and private network [OK]

Common Mistakes:

• Thinking DMZ speeds up internet
• Confusing DMZ with backup storage
• Believing DMZ replaces firewalls

2. Which device is typically used to control traffic between the internet, DMZ, and internal network?

easy

A. Firewall

B. Router

C. Switch

D. Modem

Solution

1. Step 1: Identify devices managing network traffic

   Firewalls are security devices that control and filter traffic between different network zones.

2. Step 2: Match device to DMZ traffic control

   Firewalls regulate access between the internet, DMZ, and internal network to protect sensitive data.

3. Final Answer:

   Firewall -> Option A

4. Quick Check:

   Traffic control device = Firewall = A [OK]

Hint: Firewalls filter traffic between network zones like DMZ [OK]

Common Mistakes:

• Confusing routers with firewalls
• Thinking switches control security
• Assuming modems manage internal traffic

3. Consider this simplified network setup:
Internet -- Firewall -- DMZ -- Firewall -- Internal Network
Which statement is true about traffic flow?

medium

A. Traffic from the internet can directly access the internal network

B. Traffic from DMZ can bypass firewalls to reach the internet

C. Traffic must pass through two firewalls before reaching the internal network

D. Internal network traffic goes directly to the internet without restrictions

Solution

1. Step 1: Analyze the network layout

   Traffic from the internet passes through the first firewall to enter the DMZ, then through a second firewall to reach the internal network.

2. Step 2: Understand traffic restrictions

   Firewalls control and filter traffic, so direct access from internet to internal network is blocked.

3. Final Answer:

   Traffic must pass through two firewalls before reaching the internal network -> Option C

4. Quick Check:

   Two firewalls protect internal network = B [OK]

Hint: Traffic passes through all firewalls in path order [OK]

Common Mistakes:

• Assuming direct internet access to internal network
• Believing DMZ bypasses firewalls
• Ignoring firewall filtering rules

4. A network admin set up a DMZ but notices internal users can access public web servers without firewall checks. What is the likely error?

medium

A. The internal network has no internet connection

B. The DMZ is not separated by a firewall from the internal network

C. The DMZ is connected directly to the internet without firewall

D. The firewall rules are too strict blocking all traffic

Solution

1. Step 1: Identify the problem

   Internal users accessing DMZ servers without firewall checks means no filtering between internal network and DMZ.

2. Step 2: Find the cause

   This usually happens if the DMZ is not properly separated by a firewall from the internal network.

3. Final Answer:

   The DMZ is not separated by a firewall from the internal network -> Option B

4. Quick Check:

   Missing firewall between DMZ and internal = D [OK]

Hint: Check firewall between DMZ and internal network [OK]

Common Mistakes:

• Assuming firewall rules are too strict
• Thinking DMZ connects directly to internet
• Believing internal network lacks internet

5. A company wants to host a public website and an internal database securely. Which DMZ architecture best protects the internal database?

hard

A. Place the website in the DMZ and the database behind a firewall in the internal network

B. Place both website and database in the DMZ for easy access

C. Place the database in the DMZ and the website in the internal network

D. Place both website and database directly on the internet

Solution

1. Step 1: Understand security needs

   The public website must be accessible from the internet, so it belongs in the DMZ.

2. Step 2: Protect sensitive data

   The internal database contains private data and should be behind a firewall inside the internal network, not exposed in the DMZ.

3. Step 3: Choose the best architecture

   Placing the website in the DMZ and database behind firewall inside internal network keeps data safe and services accessible.

4. Final Answer:

   Place the website in the DMZ and the database behind a firewall in the internal network -> Option A

5. Quick Check:

   Website public in DMZ, database protected internally = A [OK]

Hint: Public services in DMZ, sensitive data inside firewall [OK]

Common Mistakes:

• Putting database in DMZ exposing sensitive data
• Placing both services in DMZ risking security
• Exposing both directly to internet