Which term refers to a protected network created with a two- or three-homed firewall behind a screening firewall, commonly associated with the DMZ?

Which term refers to a protected network created with a two- or three-homed firewall behind a screening firewall, commonly associated with the DMZ?

• A. DMZ
• B. Bastion Host
• C. Demilitarized Zone (DMZ)
• D. Screened Subnet

Answer: (D)

This question tests DMZ architectures, specifically the screened-subnet design. In a two- or three-homed firewall setup, a screening firewall sits at the edge and filters traffic before it reaches the internal network. The network segment that sits behind that screening firewall—the protected subnet between the edge firewall and the internal network—is called a screened subnet. This arrangement creates a DMZ-like zone where public-facing services can run while the internal network remains shielded. The term DMZ describes the zone itself, not the exact architectural layout, and a bastion host is a single hardened host within that area, not the network structure. So the best match for the described protected network behind a screening firewall is the screened subnet.

This question tests DMZ architectures, specifically the screened-subnet design. In a two- or three-homed firewall setup, a screening firewall sits at the edge and filters traffic before it reaches the internal network. The network segment that sits behind that screening firewall—the protected subnet between the edge firewall and the internal network—is called a screened subnet. This arrangement creates a DMZ-like zone where public-facing services can run while the internal network remains shielded. The term DMZ describes the zone itself, not the exact architectural layout, and a bastion host is a single hardened host within that area, not the network structure. So the best match for the described protected network behind a screening firewall is the screened subnet.