What is the primary purpose of a perimeter network (DMZ) in a network design?

• A. To host services accessible from the Internet while isolating the internal network
• B. To store backups
• C. To replace a firewall
• D. To connect two internal networks directly

Answer: (A)

A DMZ serves as a buffer zone between the Internet and the private network, so public-facing services can be reached without exposing internal systems. By placing servers that must be accessible from outside—like web, mail, or DNS servers—in the DMZ, you limit direct access to the internal network. The firewall surrounding the DMZ enforces strict rules about what traffic is allowed to and from those servers and what can pass from the DMZ into the internal network. This containment means that even if a public-facing server is compromised, the attacker would still face another layer of protection before reaching sensitive internal resources, and administrators can monitor traffic for suspicious activity more easily.

Backups are not the purpose of a DMZ, and a DMZ does not replace a firewall. It’s not intended to connect two internal networks directly; rather, it maintains separation so only narrowly defined interactions cross between the Internet, the DMZ, and the internal network.