Definition
A demilitarized zone, or DMZ, is a perimeter network that is logically or physically separated from an organization's internal private network and the external public internet. It acts as a buffer zone, housing services that need to be accessible from the internet but should not expose the internal network. In practice, a DMZ typically contains servers such as web servers, email servers, or DNS servers, protected by firewalls on both the internet-facing and internal-facing sides. This architecture is crucial for enhancing security by isolating potentially vulnerable public-facing services from sensitive internal data. For example, a company's public website might reside in the DMZ, allowing customers to access it without granting them direct access to the internal accounting or HR systems. Unlike a fully isolated internal network, a DMZ intentionally allows controlled access from the internet. This concept is frequently tested on security certifications like CompTIA Security+ and CISSP.