A public-facing server placed in a demilitarized zone (DMZ) can connect to internal networks by default, even when no policy allows that traffic.

### Why this is right The material says a compromised DMZ system cannot connect to internal networks unless that traffic is allowed. The firewall's policy controls whether the crossing is permitted. ### The concept A DMZ is a separate network for systems that must communicate with less-trusted networks. Separation limits the consequences of compromise, but it does not by itself specify every allowed flow. Policies should permit only required connections between the DMZ and internal areas. ### The other options - **True**: this would describe a design with an explicit policy permitting the connection, not the default behavior described in the lesson. ### Terms - **DMZ**: Demilitarized Zone. A separated network for systems communicating with less-trusted networks. ### Remember DMZ placement separates a server; a policy is needed to permit traffic out of that zone.