CompTIA Network+ Practice Test

What does a screened subnet provide in terms of security?

1. Access to all internal resources

2. Public access to public resources

3. Complete isolation from the Internet

4. Additional layer of security between the network and the internet

The correct answer is: Additional layer of security between the network and the internet

A screened subnet, often referred to as a DMZ (Demilitarized Zone), is designed to add an additional layer of security between the internal network and the Internet. This setup typically involves placing certain servers that provide services to external users (like web or mail servers) in the screened subnet. By doing so, these servers are isolated from the internal network, thereby mitigating the risk of direct attacks on internal resources. The core idea is that if an attacker compromises a server in the screened subnet, they do not automatically gain access to the internal network. This additional layer acts as a buffer, allowing the organization to apply strict security measures, such as firewalls and access control lists, to monitor and control the traffic between the Internet, the screened subnet, and the internal network. This design enhances security by limiting exposure and providing a controlled environment where external attacks can be contained, thereby protecting sensitive resources within the internal network.