What is the recommended server architecture for a new web-based software package requiring three servers?

• A. A web server facing the Internet, an application server on the internal network, and a database server on the internal network.
• B. All three servers placed on the Internet.
• C. A single server performing all roles.
• D. Three servers in a DMZ with no internal network servers.

Answer: (D)

The key idea is to use a DMZ to isolate publicly accessible services and limit exposure to any internal network. Placing the three servers entirely in a DMZ creates a controlled boundary between the Internet and the rest of the infrastructure, so traffic from the Internet is filtered before it can reach sensitive systems. With no internal network servers, there’s no direct path from external attackers to internal resources, and any compromise must contend with additional firewall rules and monitoring at the DMZ boundary. This setup concentrates defense in depth in one zone, making it easier to harden, monitor, and control how the three components interact while keeping the internal network separate from public exposure.