What should inbound internet traffic be limited to in the DMZ?

• A. Inbound traffic from the Internet should be allowed to any server in the network.
• B. Traffic from the Internet should be directed only to DMZ resources, and then to internal networks.
• C. Inbound internet traffic should be limited to IP addresses within the DMZ.
• D. Inbound traffic to the DMZ should always be blocked.

Answer: (C)

The DMZ is a buffer network that hosts publicly accessible services while keeping the internal network protected. The correct approach is to allow inbound traffic from the Internet only to the DMZ hosts, i.e., limit inbound traffic to the DMZ’s IP addresses. This ensures that public-facing services are reachable without exposing internal networks, maintaining segmentation and reducing risk if a DMZ host is compromised. Allowing inbound traffic directly to internal networks would bypass the protection the DMZ provides, and blocking all inbound traffic to the DMZ would prevent legitimate public services from operating. Routing traffic beyond the DMZ into internal networks also undermines the separate security boundary the DMZ creates.