The lab asks why a DMZ host should not automatically be allowed to initiate connections into Internal. Which response best reflects the security concern?

### Why this is right The DMZ contains servers that may need to communicate with less trusted networks. Allowing those systems to initiate connections into Internal can create an unwanted path toward internal hosts. ### The concept Network zones represent different security roles. A policy between zones should reflect the trust and communication needs of those networks. The lab deliberately permits Internal-to-DMZ access without adding a general reverse rule. That design limits which side can initiate communication; it does not imply that every possible return packet is treated as a new connection. ### The other options - **B. Internal hosts cannot use Internet Protocol**: the lab uses network communication between these hosts; this is unrelated to the direction-based risk. - **C. A DMZ host cannot communicate with any other network**: the lab allows DMZ-to-Internet access in a separate rule. - **D. Allowing the traffic would automatically create a Destination NAT rule**: security policy permission and address translation are separate functions. ### Terms - **Internet Protocol (IP)**: The network-layer protocol used to address and route packets. - **Destination NAT**: Destination Network Address Translation. Translation that changes a packet's destination address. ### Remember Treat traffic initiation from a less trusted zone into a more trusted zone as a separate permission that must be justified.