What is the primary purpose of a DMZ in a network?

• A. To host publicly accessible services while isolating them from the internal network.
• B. To monitor internal employee behavior.
• C. To store secrets in an unencrypted form.
• D. To encrypt all internal communications.

Answer: (A)

The DMZ serves as a security buffer that hosts services which must be reachable from the internet, while keeping the internal network isolated. By placing public-facing servers (like web, mail, or DNS) in this separate zone and enforcing strict firewall rules between the internet, the DMZ, and the internal network, you allow external access to necessary services without exposing internal systems directly. If a DMZ service is compromised, the attacker encounters additional barriers before reaching sensitive internal resources, limiting potential damage.

This isn't about monitoring employee behavior, storing secrets unencrypted, or encrypting all internal communications. Those functions are handled by other tools and practices (monitoring/IDS, secure secret storage, and encryption protocols, respectively). The DMZ’s primary role is to provide an isolated, exposed layer for public services to reduce risk to the internal network.