What is the purpose of a DMZ in a network?

• A. DMZ is an isolated internal network.
• B. A DMZ is a firewall brand.
• C. A DMZ is to connect internal servers directly.
• D. A subnet exposing external-facing services while isolating them from the internal network.

Answer: (D)

The DMZ creates a buffer zone by placing public-facing services in a separate subnet that can be accessed from the internet, while keeping them isolated from the trusted internal network. This separation means that if a service in the DMZ is compromised, the attacker still faces additional barriers before reaching sensitive internal systems, reducing the risk of a broader breach.

In practice, a DMZ hosts things like web or mail servers that must be reachable from outside, but the traffic from the DMZ to the internal network is tightly restricted by firewalls. This setup provides controlled exposure: the public services are reachable, but access to internal resources is limited and monitored.

So, the described purpose—exposing external-facing services on a separate subnet while isolating them from the internal network—precisely captures what a DMZ is for. The other options either mischaracterize DMZ as a brand, an internal network, or imply direct connectivity that would defeat the isolation goal.