A small organization forwards a public web service to a server in a demilitarized zone (DMZ). Explain the roles of destination Network Address Translation (NAT), the firewall policy, and the server's placement.

### What a good answer covers - Destination NAT redirects the public destination to the private server. - The security policy separately determines whether the traffic is allowed. - The DMZ separates a public-facing server from internal systems. - Only the necessary service should be exposed by policy. ### The concept Destination NAT is an address-mapping function, often used for port forwarding. The security policy is an access-control function, so a translation rule alone does not permit a connection. A DMZ provides network separation for servers that need external access. If the server is compromised, restrictive policy can limit its access to internal networks. ### Terms - **DMZ**: Demilitarized Zone. A separate network for systems communicating with less-trusted networks. - **NAT**: Network Address Translation. A method of changing network addresses. - **Port forwarding**: Mapping an external address and port to an internal address and port. ### Remember Use translation to direct traffic, policy to permit it, and a DMZ to separate the exposed server.