In a dual-firewall DMZ, what is the frontend firewall configured to do?

• A. Only allow traffic destined for the DMZ
• B. Block all traffic to the DMZ
• C. Route traffic from internal network to the Internet
• D. Inspect traffic within the internal network only

Answer: (A)

In a dual-firewall DMZ, the frontend firewall is designed to act as the exposed boundary to the outside world and to permit only traffic that is destined for the DMZ resources. This means external clients can reach the DMZ servers (like a public web server) on the specific ports and protocols those servers require, while all other unsolicited traffic is blocked at the edge. The DMZ is intentionally isolated from the internal network, with the backend firewall further filtering traffic moving from the DMZ to internal systems, adding another layer of protection.

Why the other ideas don’t fit: blocking all traffic to the DMZ would prevent any necessary public-facing services from being reachable, defeating the purpose of having a DMZ. routing traffic from the internal network to the Internet is typically handled by different components and policies, not the frontend boundary that faces the external network. inspecting traffic within the internal network only describes a scope that doesn’t capture the role of the external boundary in a dual-firewall DMZ.