Which of the following is the most likely reason for an organization to implement an extranet? (Select the best
answer.)

A.
to provide customers with largescale computer services

B.
to provide internal departments with independent security policies

C.
to provide internal users with a customized website

D.
to provide customers with access to the company’s internal network

Explanation:
A company can implement an extranet to provide customers with access to the company’s internal network. An
extranet is a portion of a company’s internal network that is accessible to specific people outside of the
company, such as business partners, suppliers, or customers. By creating an extranet, a company can provide
a location for sharing information with external users. For example, a consulting company could create an
extranet for external customers to view and comment on the consulting company’s progress on various
projects. In many extranet implementations, the external customer network shares a bilateral connection with
the company’s internal network. This bilateral connection not only enables the external customer to access
portions of the company’s internal network, but it also enables portions of the company’s internal network to
access the portions of the external customer’s network.
An extranet is not implemented to provide customers with largescale computer services. A company could
implement a cloud computing infrastructure to provide largescale computer services over a vast network, such
as the Internet. Cloud computing allows for access to applications, storage space, and other services on
demand without requiring that the services be installed locally. Cloud computing can be used to replace or
supplement highly utilized local systems. The use of cloudbased services can simplify IT management by
reducing or eliminating the amount of time needed to install, upgrade, and manage services.
An extranet is not implemented to provide internal departments with independent security policies. A company
could implement security contexts on a firewall, such as the Cisco Adaptive Security Appliance (ASA), to
provide internal departments with independent security policies. Security contexts divide a single ASA into
multiple virtual devices with unique policies that can be managed by separate administrative domains. This
division enables a single physical ASA to provide security services for different departments while keeping the
departments logically separated.
An extranet is not implemented to provide internal users with a customized website. Instead, an intranet can be
created to provide internal users with their own website. An intranet provides a location for sharing informationamong members of the company. Unlike an extranet, an intranet is typically available only to internal users.

SANS: SANS Institute InfoSec Reading Room: Security Considerations for Extranets (PDF)Category: Security
Concepts