DMZ architecture in Cybersecurity - Step-by-Step Execution

Concept Flow - DMZ architecture

Internet

↓

External Firewall

↓

DMZ Zone

↓

Web Server

↓

Internal Firewall

↓

Internal Network

Traffic flows from the Internet through an external firewall into the DMZ, where public servers reside, then through an internal firewall to the internal network.

Execution Sample

Cybersecurity

Internet -> External Firewall -> DMZ -> Internal Firewall -> Internal Network

Shows the path data takes through the DMZ architecture from outside to inside.

Analysis Table

Step	Source	Firewall Check	Allowed?	Destination
1	Internet	External Firewall	Yes	DMZ
2	DMZ Server (Web)	Internal Firewall	Yes	Internal Network
3	Internet	Internal Firewall	No	Blocked
4	DMZ Server (Mail)	Internal Firewall	Yes	Internal Network
5	Internet	External Firewall	No	Blocked

💡 Traffic blocked if firewall rules do not allow passage.

State Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
Traffic Location	Internet	DMZ	Internal Network	Blocked	Internal Network	Blocked or Internal Network
Firewall Decision	N/A	Allowed	Allowed	Blocked	Allowed	Depends on rules

Key Insights - 3 Insights

Why can't traffic from the Internet go directly to the Internal Network?

Because the internal firewall blocks direct access from the Internet to protect the internal network, as shown in execution_table step 3.

Why do servers in the DMZ have access to the Internal Network?

Because the internal firewall allows specific traffic from DMZ servers to the internal network, as seen in steps 2 and 4.

What happens if the external firewall blocks traffic?

Traffic is stopped before reaching the DMZ, as shown in execution_table step 5.

Visual Quiz - 3 Questions

Look at the execution_table, at which step is traffic from the Internet blocked by the internal firewall?

A Step 3

B Step 1

C Step 2

D Step 4

💡 Hint

Check the 'Allowed?' column for 'No' at step 3.

According to variable_tracker, where is the traffic located after step 2?

A Internet

B DMZ

C Internal Network

D Blocked

💡 Hint

Look at 'Traffic Location' after Step 2.

If the external firewall blocks traffic, what is the final traffic location?

A DMZ

B Blocked

C Internal Network

D Internet

💡 Hint

Refer to execution_table step 5 and variable_tracker final state.

Concept Snapshot

DMZ architecture places public servers in a separate zone between two firewalls.
External firewall filters Internet traffic to DMZ.
Internal firewall controls DMZ to internal network access.
Protects internal network from direct Internet exposure.
Allows controlled access to public services.

Full Transcript

DMZ architecture is a security setup where public-facing servers are placed in a special zone called the DMZ. Traffic from the Internet first passes through an external firewall that filters what can enter the DMZ. Inside the DMZ, servers like web and mail servers handle public requests. To protect the internal network, an internal firewall controls traffic from the DMZ to the internal network, allowing only approved connections. Traffic directly from the Internet to the internal network is blocked by the internal firewall. This layered approach helps keep the internal network safe while still providing public services.

Practice

1. What is the main purpose of a DMZ (Demilitarized Zone) in network security?

easy

A. To store backup data securely

B. To speed up internet connection for all users

C. To replace firewalls in a network

D. To separate and protect the internal network from external threats

Solution

1. Step 1: Understand the role of DMZ

   A DMZ is a special network area that acts as a buffer between the internet and the internal network.

2. Step 2: Identify its main function

   It hosts public services like websites while protecting the private internal network from outside threats.

3. Final Answer:

   To separate and protect the internal network from external threats -> Option D

4. Quick Check:

   DMZ protects internal network = C [OK]

Hint: DMZ acts as a buffer zone between internet and private network [OK]

Common Mistakes:

• Thinking DMZ speeds up internet
• Confusing DMZ with backup storage
• Believing DMZ replaces firewalls

2. Which device is typically used to control traffic between the internet, DMZ, and internal network?

easy

A. Firewall

B. Router

C. Switch

D. Modem

Solution

1. Step 1: Identify devices managing network traffic

   Firewalls are security devices that control and filter traffic between different network zones.

2. Step 2: Match device to DMZ traffic control

   Firewalls regulate access between the internet, DMZ, and internal network to protect sensitive data.

3. Final Answer:

   Firewall -> Option A

4. Quick Check:

   Traffic control device = Firewall = A [OK]

Hint: Firewalls filter traffic between network zones like DMZ [OK]

Common Mistakes:

• Confusing routers with firewalls
• Thinking switches control security
• Assuming modems manage internal traffic

3. Consider this simplified network setup:
Internet -- Firewall -- DMZ -- Firewall -- Internal Network
Which statement is true about traffic flow?

medium

A. Traffic from the internet can directly access the internal network

B. Traffic from DMZ can bypass firewalls to reach the internet

C. Traffic must pass through two firewalls before reaching the internal network

D. Internal network traffic goes directly to the internet without restrictions

Solution

1. Step 1: Analyze the network layout

   Traffic from the internet passes through the first firewall to enter the DMZ, then through a second firewall to reach the internal network.

2. Step 2: Understand traffic restrictions

   Firewalls control and filter traffic, so direct access from internet to internal network is blocked.

3. Final Answer:

   Traffic must pass through two firewalls before reaching the internal network -> Option C

4. Quick Check:

   Two firewalls protect internal network = B [OK]

Hint: Traffic passes through all firewalls in path order [OK]

Common Mistakes:

• Assuming direct internet access to internal network
• Believing DMZ bypasses firewalls
• Ignoring firewall filtering rules

4. A network admin set up a DMZ but notices internal users can access public web servers without firewall checks. What is the likely error?

medium

A. The internal network has no internet connection

B. The DMZ is not separated by a firewall from the internal network

C. The DMZ is connected directly to the internet without firewall

D. The firewall rules are too strict blocking all traffic

Solution

1. Step 1: Identify the problem

   Internal users accessing DMZ servers without firewall checks means no filtering between internal network and DMZ.

2. Step 2: Find the cause

   This usually happens if the DMZ is not properly separated by a firewall from the internal network.

3. Final Answer:

   The DMZ is not separated by a firewall from the internal network -> Option B

4. Quick Check:

   Missing firewall between DMZ and internal = D [OK]

Hint: Check firewall between DMZ and internal network [OK]

Common Mistakes:

• Assuming firewall rules are too strict
• Thinking DMZ connects directly to internet
• Believing internal network lacks internet

5. A company wants to host a public website and an internal database securely. Which DMZ architecture best protects the internal database?

hard

A. Place the website in the DMZ and the database behind a firewall in the internal network

B. Place both website and database in the DMZ for easy access

C. Place the database in the DMZ and the website in the internal network

D. Place both website and database directly on the internet

Solution

1. Step 1: Understand security needs

   The public website must be accessible from the internet, so it belongs in the DMZ.

2. Step 2: Protect sensitive data

   The internal database contains private data and should be behind a firewall inside the internal network, not exposed in the DMZ.

3. Step 3: Choose the best architecture

   Placing the website in the DMZ and database behind firewall inside internal network keeps data safe and services accessible.

4. Final Answer:

   Place the website in the DMZ and the database behind a firewall in the internal network -> Option A

5. Quick Check:

   Website public in DMZ, database protected internally = A [OK]

Hint: Public services in DMZ, sensitive data inside firewall [OK]

Common Mistakes:

• Putting database in DMZ exposing sensitive data
• Placing both services in DMZ risking security
• Exposing both directly to internet