PGCB Assistant Engineer (CSE): Exam: 17.05.2024 (BUET)প্রশ্ন ও সমাধান

Demilitarized Zone (DMZ): A DMZ is a separate physical or logical subnetwork that sits between an organization's trusted internal LAN and an untrusted external network (the Internet), hosting public-facing services (web server, mail server, DNS) so that even if one is compromised, the attacker still cannot directly reach the internal network.

graph LR
    Internet((Internet)) --> FW1["External Firewall"]
    FW1 --> DMZ["DMZ<br/>(Web/Mail/DNS Servers)"]
    DMZ --> FW2["Internal Firewall"]
    FW2 --> LAN["Internal LAN<br/>(Employee workstations, databases)"]

Traffic from the Internet can only reach the DMZ; a second firewall separately controls what (if anything) the DMZ can reach inside the internal LAN -- giving "defense in depth" with two layers instead of one.

Sandbox: A sandbox is an isolated, controlled execution environment used to run untrusted or suspicious code (e.g. potential malware, unverified email attachments) and observe its behavior, without risking the security of the actual host system or production network. Anything the code does inside the sandbox (file writes, network calls) is contained and can be discarded afterward.

Example: A security team receives a suspicious email attachment; instead of opening it on a real employee laptop, they detonate it inside a sandboxed virtual machine to observe whether it tries to encrypt files (ransomware behavior) or contact a command-and-control server.

Exam takeaway: DMZ isolates public-facing servers from the internal network at the architecture level; a sandbox isolates the execution of a single suspicious program at the runtime level -- both apply the same core security principle of containment/isolation, at different scopes.