AP Cybersecurity Drill 12: Placing a Public Web Server

Question 1. Reading the table and the current plan, what is the main risk of leaving the public web server on the same internal network as the records server?

• A) The public web server will run measurably slower because the records server keeps consuming bandwidth
• B) A compromise of the internet-facing web server puts the attacker inside the network near the records ✓
• C) The private records server will end up being crawled, indexed, and listed by public search engines
• D) Registrar staff in the back office will no longer be able to send any print jobs to the public web server

Explanation: Choice B is correct. The web server is exposed to the whole internet, so if it is compromised it becomes a foothold; because it sits on the internal network next to the records server, the attacker can then try to reach grades and financial-aid files. Choice A is incorrect. Shared bandwidth is a performance detail, not the security risk the lead is trying to remove. Choice C is incorrect. Placement on the internal network does not cause a private records server to be indexed by search engines. Choice D is incorrect. Printing is unrelated to the exposure created by co-locating a public server with sensitive data.

Question 2. Which network design best lets outsiders reach the web server while keeping them away from the records and file servers?

• A) Put the web server in a screened subnet, also called a DMZ, and keep the other two servers internal ✓
• B) Move all three of the institute's servers out onto the public internet so they are all easy to reach
• C) Give the public web server and the internal records server the very same network address to share
• D) Turn the firewall off completely so that traffic is able to flow freely between all of the servers

Explanation: Choice A is correct. A screened subnet, also called a DMZ, is a separated segment for public-facing systems; placing the web server there and keeping the records and file servers on the internal network lets the internet reach only the DMZ, not the private data. Choice B is incorrect. Putting the records and file servers on the public internet exposes exactly the data the lead wants to protect. Choice C is incorrect. Sharing an address does not separate the servers and would break routing. Choice D is incorrect. Disabling the firewall removes the boundary that keeps outsiders away from internal systems.

Question 3. With the web server in the DMZ, which firewall rule arrangement matches the access needs in the table?

• A) Allow the public internet to reach every one of the three servers on every available port, unrestricted
• B) Block all inbound traffic to the public web server while allowing the internet to reach the records server
• C) Allow the records server to be reachable from the public internet, but only during the weekend hours
• D) Allow the internet to the DMZ web server only on the web port, HTTPS/443, and block the internal servers ✓

Explanation: Choice D is correct. Permitting inbound internet traffic only to the DMZ web server on the required web service port, such as HTTPS/443, while blocking internet-initiated traffic to the internal servers, gives the public access to the catalog while keeping outsiders away from grades and staff files. Choice A is incorrect. Allowing the internet to reach every server on every port exposes the sensitive servers, the opposite of the goal. Choice B is incorrect. Blocking the web server and exposing the records server inverts what each server needs. Choice C is incorrect. The records server should never be reachable from the internet; a weekend window still exposes it.

Question 4. Why does placing the web server in a DMZ reduce risk even if that web server is eventually compromised?

• A) Because putting a server inside a DMZ makes that particular server effectively impossible for anyone to hack
• B) Because servers that sit inside a DMZ segment no longer have to be patched or updated on a regular basis
• C) Because the inner firewall boundary still separates the DMZ from the internal records and file servers ✓
• D) Because a DMZ will automatically encrypt every one of the files that are stored on the web server in it

Explanation: Choice C is correct. The value of the DMZ is the boundary behind it: even a fully compromised web server is still separated from the internal network by the inner firewall, so reaching the records and file servers is not automatic. Choice A is incorrect. No placement makes a server impossible to hack; the DMZ limits the damage, it does not prevent compromise. Choice B is incorrect. Servers in a DMZ still require patching; being public-facing makes patching more important. Choice D is incorrect. A DMZ is a placement and filtering concept; it does not automatically encrypt a server's stored files.

Question 5. After the redesign, which monitoring step would most directly help the IT lead detect an attacker trying to pivot from the DMZ web server toward the internal records server?

• A) Check each morning that the public course-catalog pages hosted on the web server still load correctly
• B) Review the inner firewall's logs for connection attempts from the DMZ web server toward internal servers ✓
• C) Count how many prospective students viewed the institute's public admissions pages over the past week
• D) Confirm on a regular set schedule that the web server's assigned internal network address has not changed

Explanation: Choice B is correct. In this design, the public web server has no stated need to start connections to the internal records server, so reviewing the inner firewall's logs for DMZ-to-internal attempts is the most direct way to catch a pivot. Choice A is incorrect. Confirming the public pages load checks availability, not whether the web server is reaching toward internal systems. Choice C is incorrect. Visitor counts measure traffic volume, not lateral movement. Choice D is incorrect. Verifying the web server's address is unchanged does not reveal connection attempts toward the records server.