What is a key security difference between single-firewall and dual-firewall DMZ architectures?

• A. Dual-firewall introduces a dedicated firewall between DMZ and internal network, increasing segmentation
• B. Single-firewall provides better isolation than dual
• C. Dual-firewall uses no firewall between DMZ and internal network
• D. Single-firewall uses more network interfaces than dual

Answer: (A)

The essential idea is how many control points separate the DMZ from the internal network and how that affects isolation. In a single-firewall DMZ, there’s one firewall sitting at the boundary between the DMZ and the internal network. That means all traffic moving from the DMZ into the internal network must pass through that same point of enforcement, which provides some protection but also creates a single chokepoint that, if bypassed or misconfigured, can expose the internal network.

In a dual-firewall setup, you add a second firewall between the DMZ and the internal network. This creates two separate security zones with distinct controls: traffic from the Internet goes through a firewall into the DMZ, then must pass through a second firewall to reach the internal network. This increases segmentation and defense in depth because each boundary can have its own, potentially stricter, policies and monitoring. If a DMZ host is compromised, the blast radius is limited by the extra layer, making it harder for an attacker to reach the internal network directly.

So the key difference is the added layer of separation between DMZ and internal networks, which enhances isolation. The other ideas don’t fit because a single firewall does not provide the same level of internal isolation, there isn’t a design where a DMZ and internal network are truly unlocked by having no firewall between them, and typically a dual-firewall design uses more rather than fewer interfaces due to the extra boundary.