A DMZ is bordered by 2 firewalls.

A Demilitarized Zone (DMZ) is a controlled network segment positioned between an organization's trusted internal environment and an external, untrusted environment such as the Internet. In the classic architecture described in DAMA-DMBOK2, the DMZ is separated from the Internet by an external firewall and from internal organizational systems by another firewall. Therefore, the correct answer is Internet and internal systems.

DMBOK2 describes the DMZ as an area on the organization's perimeter, with firewall protection separating it from the organization and firewall protection between the DMZ and the Internet. It is commonly used for services or transient data exchanges that must interact with external parties without providing direct access to internal systems.

This arrangement implements defense in depth. Public-facing services can operate in the DMZ while internal databases and sensitive systems remain behind an additional security boundary. A compromise of a DMZ host should therefore not automatically expose the internal network.

For Data Quality, security architecture is relevant because unauthorized modification or corruption can compromise integrity and accuracy. Protecting interfaces and repositories supports trustworthy data processing as well as confidentiality and availability.

Reference Topics: DAMA-DMBOK2 Chapter 7 — Data Security; Network Security; Perimeter; DMZ; Firewalls; Integrity Protection.

===============