L40
Zone-based security and screened subnets
Cram this first — memory hook
Public service in the middle; private data behind another controlled boundary.
Exam trap
Compromise of a Demilitarized Zone server remains dangerous. Segmentation limits paths; it does not make the compromised system harmless.
The slide facts
Zones separate guests, private clients, public servers and administrative resources. A screened subnet/ hosts public-facing services while isolating private systems.
If you have time — extra
A security zone groups systems with similar access requirements and applies policy to traffic between groups. A Demilitarized Zone (), also called a screened subnet in these slides, is a controlled place for public-facing services such as a reverse proxy or web server. It is not an unrestricted trusted extension of the internal network. Imagine reception, staff offices and a records room: visitors can reach reception without wandering into records. A web server may need a specific connection to an internal database; that does not justify letting every internet host connect to the database. Management traffic should be restricted to authorized administrative sources. Guests normally receive internet access and necessary supporting services, not general access to payroll or industrial controllers. A Virtual Local Area Network can help define a boundary, but routing/firewall policy enforces cross-zone restrictions.
Walkthrough
List required flows, place systems into appropriate zones, allow only the necessary source/destination/service combinations, deny unwanted paths, then test both legitimate and forbidden traffic.