just a quick add-on.
dmz is used to host public server such as web server, which in turn connects to the database server located in the inside subnet.
inbound access usually is retricted to the dmz server, such as tcp 80 for a web server. the web server is then restricted to access the database server with one or two ports permitted.
providing a dmz server has been compromised, the intruder would not immediately gain full access to the inside subnet except the specific ports to the database server. again, the intruder needs to spend some extra time to crack into the database server from the web server. and hopefully, the security administrator would have enough time to be alerted and react on it.
