Security+ ยท 3.0 Security Architecture
DMZ (Demilitarized Zone)
A network segment that hosts externally-facing services (web, mail, DNS) in isolation from the internal network. Compromise of a DMZ host shouldn't directly reach internal.
How this shows up at NCAE
The NCAE topology has your server in a semi-DMZ posture: exposed to the scoring engine through NAT, isolated from a real internal network. Think about what your server can reach if compromised.