Public-facing systems (such as web servers) must be separated from internal enterprise networks to limit exposure. CMMC (aligned with NIST SP 800-171 SC.L2-3.13.5 "Boundary Protection") specifies that placing public servers into a demilitarized zone (DMZ) provides a security buffer and prevents direct access from the internet into the internal LAN.
Exact extracts:
* "Publicly accessible systems should be placed on separate subnets or in DMZs."
* "Boundary protection devices should separate public servers from the enterprise network."
* "DMZs provide layered protection for internet-facing assets."
Why the other options are incorrect:
* A: Relocating the server physically does not provide network-layer security.
* C: Firewall rules allowing only internal traffic would prevent public access, defeating the purpose of a public website.
* D: Object reuse protections are unrelated to network boundary security.
References:
CMMC Assessment Guide - Level 2, SC.L2-3.13.5 "Boundary Protection."
NIST SP 800-171 Rev. 2, 3.13.5.