How to Route Multiple Internal Web Servers Through One External IP?

SY0-601 By islever Editorial Last updated

Short answer

B Deploy a reverse proxy to route multiple internal web applications through a single external IP address based on requested URLs.

Question

A security administrator needs to publish multiple application URLs that will run on different internal web servers but use only one external IP address. Which of the following is the best way for the administrator to achieve this goal?
  1. Jump server
  2. Reverse proxy Correct Answer
  3. MAC filtering
  4. Source NAT

Key Takeaways

This question tests understanding of application-layer traffic routing versus network-layer address translation, where candidates often confuse reverse proxies with source NAT or destination port forwarding.

A reverse proxy enables administrators to expose multiple internal web applications through a single public IP by routing inbound traffic based on hostnames or URL paths while masking backend infrastructure.

Common mistake: Candidates frequently select Source NAT, mistaking it for the mechanism that hides internal addresses, but source NAT only modifies outbound traffic headers and cannot route inbound requests to different backend servers by URL.

Expert Analysis

Why the Answer Is Correct

A reverse proxy operates at the application layer and acts as an intermediary between clients and backend web servers. By listening on a single public IP address, it examines the requested hostname or URL path in incoming HTTP/HTTPS traffic and intelligently forwards requests to the appropriate internal server. This architecture not only fulfills the requirement to publish multiple application URLs through one external IP but also provides critical security benefits like SSL termination, load balancing, and IP address masking.

Why the Other Options Are Wrong

Jump servers are dedicated bastion hosts designed for secure administrative access to restricted networks, not for routing web traffic. MAC filtering operates exclusively at Layer 2 to permit or block devices based on hardware addresses, making it completely irrelevant to IP-based web publishing. Source NAT translates private source addresses to a public IP for outbound communications, but it lacks the application-layer inspection required to route inbound requests to different backend servers based on URLs.

Community Comment Notes

Learners consistently recognize that reverse proxies solve this exact scenario, with several noting how tools like NGINX effortlessly handle URL-based routing. Users who initially selected source NAT quickly realized it only handles outbound traffic direction and cannot parse HTTP host headers. Others highlighted the security advantages, pointing out that hiding backend server IPs makes it significantly harder for attackers to launch targeted DDoS campaigns. As salah112 noted, the reverse proxy approach is simply the best solution for achieving this specific publishing goal.

Exam Strategy

When reviewing network architecture questions on the Security+ exam, always identify whether the scenario requires Layer 3/NAT functions or Layer 7/proxy functions before selecting an answer. Focus on keywords like 'publish URLs' or 'route traffic,' which strongly indicate an application-layer solution rather than basic address translation.

Frequently Asked Questions

Why isn't Source NAT the right choice for publishing internal web servers?

Source NAT only modifies outbound packet headers to hide internal IPs; it cannot route inbound HTTP requests to different backend servers based on URLs or hostnames.

How does a reverse proxy handle multiple domains on one IP?

It inspects the Host header in incoming HTTP/HTTPS requests and forwards traffic to the appropriate internal server, enabling virtual hosting without additional public IPs.

More SY0-601 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. 7308365 👍 10
    B. Reverse Proxy My first question to this question was why would they want to do that? So I investigated and these are some of the examples I found for why: A reverse proxy can be used to protect a website because the websites IP addresses are hidden behind the reverse proxy and are not revealed to clients. This makes it much harder to target a DDoS attack against a website. A reverse proxy is also used for load balancing. A popular website handling millions of users every day is unlikely to be able to handle the traffic with a single server. A reverse proxy can balance a large amount of incoming requests by distributing the traffic to a large pool of web servers, and effectively preventing any single one of them from becoming overloaded. Services like cloudflare put reverse proxy servers in hundred of locations all around the world. This puts the reverse proxy close to the users and at the same time provides a large amount of processing capacity
  2. salah112 👍 2 Answered B
    B. Reverse proxy A reverse proxy is the best solution for achieving the goal of publishing multiple application URLs that run on different internal web servers but use only one external IP address.
  3. DrZoidBergsClaws 👍 2
    I believe the correct answer is D
  4. dfc6822 👍 1
    B. Reverse proxy A reverse proxy is the best way for a security administrator to achieve the goal of publishing multiple application URLs that run on different internal web servers but use only one external IP address.
  5. Securityguy42 👍 1 Answered B
    I was thinking D at first, but after watching this vid. Reverse proxy makes the most sense. https://youtu.be/AuINJdBPf8I?si=CCJjXy12dMRZ4ehh
Show 4 more comments
  1. ganymede 👍 1 Answered B
    B. Reverse proxy I did some research and found that the NGINX proxy can do this.
  2. Hs1208 👍 1
    B. Reverse proxy
  3. Benrosan 👍 1 Answered B
    Reverse prox.
  4. johnabayot 👍 1 Answered B
    Reverse proxy

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

MFA and Patch Management Control Type and Category

S-grade

Threat Hunting Data Sources for Exploitable Systems

S-grade

Full Weekly and Differential Daily Backup Strategy

S-grade

Access Auditing as the SaaS Vendor Risk to Focus On

S-grade

← Back to SY0-601 Study Guide