Which subnetwork is designed to be unsecured and exposed to external services?

• A. Demilitarized Zone (DMZ)
• B. Intranet
• C. Extranet
• D. Virtual Private Network

Answer: (A)

This is about placing services that must be reachable from the outside in a separate, exposed subnetwork while keeping the rest of the internal network shielded. A DMZ is designed exactly for this role: it sits between the public internet and the trusted internal network, hosting public-facing resources such as web servers, mail servers, and DNS. The goal is to make those services accessible to external users while restricting what an attacker can reach if a DMZ host is compromised. Firewalls and careful network design separate the DMZ from the internet and from the internal network, enforcing strict controls on what traffic can travel to and from the DMZ.

The other options aren’t designed to be unsecured and exposed in the same way. An intranet is a private network for internal users, not meant to be openly accessible from the internet. An extranet extends some access to external partners or customers, but it’s still a controlled, protected environment, not an intentionally unsecured space. A VPN creates a secure, encrypted tunnel for remote access to internal resources, so security and confidentiality are central, not exposure.