The recommended architecture for secure web application deployment is a multi-tiered setup:
Web server in the DMZ (public-facing)
Application server on the internal network
Database server on the internal network
This design limits the exposure of critical components. Only the web server is exposed to the internet, while application and database servers are shielded by firewalls and only accessible internally.
Reference - CEH v13 Official Study Guide:
Module 10: Hacking Web Servers
Quote:
"Place the web server in the DMZ and keep the application and database servers within the internal network.
This reduces the attack surface and provides layered security."
Incorrect Options Explained:
A). Internal placement makes them inaccessible externally.
C & D. Exposing the database or all servers to the internet introduces significant risk.

Simple Network Management Protocol (SNMP) enumeration involves querying devices on the network for information such as routing tables, interface statistics, and system details.
Useful tools include:
* A. SNMPUtil: A command-line Microsoft utility for sending SNMP requests.
* B. SNScan: Tool from Foundstone for SNMP scanning and enumeration.
* C. SNMPScan: Lightweight tool for scanning networks for SNMP-enabled devices.
* D. SolarWinds IP Network Browser: A commercial tool for graphical SNMP enumeration.
From CEH v13 Courseware:
* Module 4: Enumeration
* Subsection: SNMP Enumeration Tools
Incorrect Option:
* E. NMap can detect SNMP services, but is not specialized for SNMP enumeration like the others.
Reference:CEH v13 Study Guide - Module 4: SNMP Enumeration ToolsRFC 1157 - SNMP Protocol Specification

The correct answer is C because network segmentation most directly disrupts the spread of ransomware across an organization. Ransomware encrypts or locks systems and demands payment for recovery; examples such as WannaCry are commonly discussed because they spread through vulnerable systems and network services. In the retrieved CEH-aligned material, WannaCry spread via SMB by scanning from an infected computer for other vulnerable systems and then executing against the next machine. Network segmentation reduces this risk by dividing the network into separate zones or VLANs and restricting unnecessary east-west communication between departments, servers, workstations, and critical systems. If one endpoint is infected, segmentation can prevent the malware from reaching file servers, domain controllers, backups, and other endpoints. Backups are extremely important for recovery, but they do not stop spread. IDS may detect suspicious activity, and AV may block known malware, but segmentation is the defense that most directly limits ransomware propagation.