Objective 3.2High11 min

Device Placement and Security Zones

Strategic placement of security devices and defining network security zones. Covers DMZ architecture, screened subnets, internal networks, trust boundaries, and proper segmentation for defense in depth.

Understanding Device Placement and Security Zones

Security zones define areas of different trust levels within a network. Strategic device placement creates boundaries between these zones, controlling what traffic can flow where and protecting sensitive assets from external and internal threats.

Key security zone concepts: • DMZ (Screened Subnet) — Buffer zone between untrusted and trusted networks • Internal Zone — Trusted network with sensitive resources • External Zone — Untrusted internet-facing network • Trust Boundaries — Points where trust levels change

The 2013 Target breach occurred because attackers compromised an HVAC vendor with network access, then moved laterally to payment systems. Proper zone segmentation would have contained the breach—the HVAC system should never have had a path to cardholder data.

Understanding zone architecture is fundamental to network security design.

Why This Matters for the Exam

Device placement and security zones are heavily tested on SY0-701 as they form the foundation of network security architecture. Questions cover DMZ design, device placement decisions, and trust boundary concepts.

Understanding zones helps with network design, compliance requirements (PCI DSS requires segmentation), and incident containment. Poor zone design enables lateral movement.

The exam tests both conceptual understanding and practical device placement scenarios.

Deep Dive

What Is a DMZ and Why Is It Called a Screened Subnet?

A DMZ (Demilitarized Zone) is a network segment that sits between external (untrusted) and internal (trusted) networks.

DMZ Purpose:

  • •Host public-facing services (web, email, DNS)
  • •Isolate external-facing systems from internal network
  • •Provide buffer zone if external systems compromised
  • •Control traffic flow between zones

Why "Screened Subnet":

  • •The DMZ is "screened" by firewalls on both sides—traffic must pass through security controls to enter or exit.

Basic DMZ Architecture:

DMZ (Screened Subnet) Architecture
Internet
External Firewall
DMZ
Web
Mail
DNS
Internal Firewall
Internal Network
Database
Apps
Users
Public-facing servers in DMZ • Sensitive data stays internal

What Devices Belong in Each Security Zone?

DMZ (Screened Subnet) Devices:

DevicePurposeWhy in DMZ
Web serversPublic website hostingNeeds internet access
Mail relayEmail gatewayProcesses external email
Reverse proxyFrontend for internal appsShields internal servers
VPN concentratorRemote access endpointTerminates external connections
DNS (external)Public name resolutionServes external queries

Internal Zone Devices:

DevicePurposeWhy Internal
Database serversStore sensitive dataNo direct external access
Application serversBusiness logicProtected from internet
Domain controllersAuthenticationCritical infrastructure
File serversInternal storageSensitive documents
WorkstationsEnd-user systemsProtected users

How Should Firewalls Be Placed in a Multi-Zone Architecture?

Dual-Firewall DMZ (Most Secure):

Dual-Firewall DMZ
Most Secure
Internet
Firewall 1
(Vendor A)
DMZ
Firewall 2
(Vendor B)
Internal Network
Different vendors = different vulnerabilities • Defense in depth

Benefits of Dual-Firewall:

  • •Defense in depth
  • •Vulnerability in one doesn't compromise both
  • •Different vendors = different vulnerabilities
  • •Clear separation of rules

Single-Firewall DMZ (Three-Legged):

Single-Firewall DMZ (Three-Legged)
Internet
DMZ
Internal
Firewall
Less expensive • Single point of failure • All rules on one device

Trade-offs:

  • •Less expensive
  • •Single point of failure
  • •All rules on one device
  • •Adequate for smaller environments

What Are Trust Boundaries and Why Do They Matter?

Trust boundaries are points where the level of trust changes between network segments.

Trust Levels:

Network Trust Levels
Untrusted
Internet
→
Limited
DMZ
→
Trusted
Internal
→
Restricted
Databases
Controls at each trust boundary: firewall, auth, logging, inspection

At Each Trust Boundary:

  • •Traffic must be inspected
  • •Access controls enforced
  • •Logging occurs
  • •Authentication may be required

Trust Boundary Controls:

BoundaryControls
Internet → DMZFirewall, IPS, WAF
DMZ → InternalFirewall, application proxy
Internal → RestrictedFirewall, MFA, PAM
User → ServerAuthentication, authorization

What Is the Principle of Least Route?

Only necessary traffic paths should exist between zones.

Principle of Least Route
Bad: Flat Network
All Systems
↔
All Systems
Everything talks to everything
Good: Segmented
Internet → Web → App → DBNo direct Internet→DB path
Only necessary traffic paths should exist between zones

Least Route Principles:

  • •No direct external-to-internal paths
  • •DMZ systems cannot initiate internal connections
  • •Internal systems access DMZ only as needed
  • •Databases never directly internet-accessible

How Do You Implement Micro-Segmentation?

Micro-segmentation extends zone concepts to workload level.

Traditional Zones vs Micro-Segmentation
Traditional Zones
Zone A
(many servers)
←FW→
Zone B
(many servers)
Micro-Segmentation
[S1] ←policy→ [S2][S2] ←policy→ [S3]Per-workload policies
Limits lateral movement • Zero trust implementation

Benefits:

  • •Limit lateral movement
  • •Zero trust implementation
  • •Granular access control
  • •East-west traffic protection

How CompTIA Tests This

Example Analysis

Scenario: A company's network has a web server, application server, and database server. Currently, all three are on the same network segment. The web server is internet-accessible, and the database contains customer PII. Design proper zone placement.

Analysis - Zone Architecture Design:

Three-Tier Zone Architecture
Internet
External Firewall
DMZ Zone
Web Server
Internal Firewall
Application Zone
App Server
Data Zone Firewall
Data Zone
Database (PII)
Each tier only communicates with adjacent tiers • Never skip levels

Traffic Flow Rules:

SourceDestinationAllowed
InternetWeb ServerHTTPS (443) only
InternetApp ServerDENIED
InternetDatabaseDENIED
Web ServerApp ServerAPI port only
Web ServerDatabaseDENIED
App ServerDatabaseSQL port only

Security Benefits:

  • 1.Web compromise doesn't reach database directly
  • 2.Each tier has minimal necessary access
  • 3.Multiple firewalls provide defense in depth
  • 4.Lateral movement requires multiple compromises
  • 5.PCI DSS segmentation requirements met

Key insight: Three-tier applications need three security zones. Each tier should only communicate with adjacent tiers, never skip levels.

Key Terms

device placementsecurity zonesDMZscreened subnettrust boundariesnetwork segmentationperimeter security

Common Mistakes

Putting databases in the DMZ—databases with sensitive data should NEVER be in the DMZ. They belong in the most protected internal zone.
Allowing DMZ to initiate internal connections—DMZ systems should respond to internal requests, not initiate connections inward.
Flat networks with no segmentation—all systems on one network means compromise of any system threatens all systems.
Single firewall for all zones—while acceptable for small environments, dual-firewall DMZ provides better defense in depth.

Exam Tips

DMZ = Screened subnet = buffer zone. Public-facing servers go here (web, mail, VPN concentrators).
If a question asks where to put a database server, the answer is NEVER the DMZ—always the internal/protected zone.
Dual-firewall DMZ is more secure than single (three-legged) firewall because a vulnerability in one doesn't compromise both.
Trust boundary = where trust level changes. Controls (firewalls, authentication) are placed at trust boundaries.
When designing zones, apply "least route"—only necessary paths should exist. No direct internet-to-database routes.
For PCI DSS scenarios, cardholder data must be in a separate, protected segment—not accessible from the DMZ.

Memory Trick

DMZ Location Memory: "The DMZ is the Middle Zone" Internet → [DMZ] → Internal Like an airport security checkpoint between public areas and gates.

  • •What Goes Where - "PIP" Rule:
  • •Public-facing → DMZ (web, mail, VPN)
  • •Internal apps → Internal zone
  • •Precious data → Protected/restricted zone
  • •Trust Boundary Checkpoint:
  • •Think of trust boundaries like TSA checkpoints:
  • •Show ID (authentication)
  • •Bag check (traffic inspection)
  • •Only allowed items (access control)
  • •Log your entry (audit)

Three-Tier Architecture Memory: ``` "Never skip a tier!" Web → App → Data ↓ ↓ ↓ DMZ → Internal → Restricted

Web can't talk to Data directly Like a receptionist can't access the vault ```

Dual Firewall Rule: "Different vendors, different vulnerabilities, double defense"

Test Your Knowledge

Q1.A company needs to deploy a public-facing web server that connects to an internal database. Where should the web server be placed?

Q2.What is the PRIMARY security advantage of using two firewalls from different vendors for a DMZ architecture?

Q3.Which systems should NEVER be placed in a DMZ?

Want more practice with instant AI feedback?

Continue Learning

Firewall TypesNetwork Appliance Types

Ready for the Exam?

See exactly where you stand on this concept and 182 others.

99% pass rate · Pass guarantee

Architecture ConsiderationsFailure Modes