Which term describes a boundary network that hosts public-facing services to shield the internal network?

• A. Demilitarized Zone (DMZ)
• B. Private Cloud
• C. Intranet
• D. VPN Gateway

Answer: (A)

A DMZ is a boundary network designed to expose publicly accessible services while protecting the internal network. It sits between the Internet and the organization’s private network, hosting services that must be reachable from outside—like web servers, mail servers, or DNS—from inside this isolated zone. By placing these services in the DMZ and applying strict firewall rules, you limit exposure to the internal hosts. If a public service in the DMZ is compromised, the attacker must still breach additional barriers to reach sensitive internal systems, reducing impact.

In typical setups, you’ll see either a single firewall with separate interfaces for the external network, DMZ, and internal network, or two firewalls forming a screened subnet. Firewalls enforce minimal necessary traffic to and from the DMZ, and traffic from the DMZ to the internal network is tightly controlled and monitored. Additional protections like reverse proxies, load balancers, and intrusion detection systems are commonly deployed in or around the DMZ to further bolster security.

The other terms describe different concepts: a private cloud is an internal pool of computing resources; an intranet is the organization’s internal network; a VPN gateway provides secure remote access into the network. None designate a dedicated boundary network whose primary purpose is hosting public-facing services to shield the internal network.