A demilitarized zone (DMZ) is a screened subnet that sits between an untrusted network, usually the internet, and an organization’s internal network, and it hosts the services that have to be reachable from the outside.
Public-facing servers such as web, mail, and external DNS live in the DMZ, typically framed by two layers of filtering: one firewall between the internet and the DMZ, and another between the DMZ and the internal LAN. The payoff shows up during a breach. If an exposed web server is compromised, the attacker lands in the DMZ and still faces a barrier before reaching the sensitive systems on the inside.
The classic error is allowing DMZ hosts to open connections back into the internal network for convenience, which quietly erases the separation the design was meant to create. Traffic should flow inward toward the DMZ, and internal systems should not trust DMZ hosts by default.
How is a DMZ tested on the CISSP?
It is part of Domain 4, Communication and Network Security, worth 13% of the exam. Expect network segmentation scenarios that ask where a given service belongs, how the firewalls are arranged, and how a DMZ supports defense in depth.