ibps-so 2016 · Question 15 of 394

The corporate web server, the public mail relay and the server that answers name queries from outside all stood, until the review, upon the same internal segment as the core banking database. The reviewer has required that they be moved to a segment of their own, standing between an outer rewall that faces the internet and an inner rewall that faces the bank's own network; the outer rewall is to admit from the internet only the tra c those three servers must answer, and the inner rewall is to admit into the internal network nothing raised in that middle segment except the few speci c connections the applications require. The arrangement so required is called a demilitarised zone, and its purpose is correctly stated as follows:

1. AIt places the publicly reachable servers in a perimeter network of their own, so that an attacker who compromises one of them is still separated from the internal network by a second rewall and has not thereby obtained a position upon the segment carrying the core banking databaseCorrect
2. BIt removes the need for a rewall altogether, the segregation of the servers being su cient protection in itself
3. CIt ciphers all tra c passing between the internet and the public servers, so that no attacker can read what those servers send
4. DIt gives the public servers addresses drawn from a private range, so that they cannot be reached from the internet at all
5. EIt duplicates the public servers so that one may take over when the other fails, the object of the arrangement being availability rather than containment