In a DMZ with a single firewall architecture, how many network interfaces are typically involved?

• A. Two
• B. Three
• C. Four
• D. Three or more

Answer: (D)

The essential point is network segmentation: a DMZ sits between the untrusted external network and the trusted internal network, so traffic must be separated across interfaces. With a single firewall protecting the DMZ, you need at least three network interfaces—one to the external/public side, one to the DMZ where the public servers live, and one to the internal/trusted network. In many deployments you might add more interfaces for management or additional internal segments, so three or more is the typical scenario. Two interfaces wouldn’t provide the necessary DMZ separation, while four is possible but simply indicates a larger or more complex setup.