Should every device on the Internet have access to internal devices? Explain how firewall rules and a demilitarized zone (DMZ) help control exposure.

### What a good answer covers - Internet access to internal devices should not be granted indiscriminately. - Rules define permitted sources, destinations, services, and actions. - The implicit deny blocks traffic that has no matching allow rule. - A DMZ can host services intended for external access while separating them from internal systems. ### The concept A firewall provides a controlled point between networks. Rules limit which services can cross that point. A DMZ is a separate network for public-facing services, such as web or mail servers. If an external system is compromised, policy separation can restrict its ability to reach internal resources. ### Terms - **DMZ**: Demilitarized Zone. A separated network for systems communicating with less-trusted networks. - **Implicit deny**: The default denial applied when no policy rule matches. ### Remember Permit the specific external service that is required, not unrestricted access to internal devices.