When configuring services in the DMZ to exchange data with the internal LAN which scenario would be more secure:
DMZ service pushes data to LAN service
or
LAN service pulls data from DMZ service
Which would be more secure, to expose service running in DMZ to accept connections from LAN or prepare LAN service to be able to accept connections from DMZ.
There are different architectures in place, some use a single firewall and others use a two firewall setup.
What you're really asking is which direction TCP connections can be opened as that's what needs to be put into stateful firewall rules. The goal of having a DMZ is to provide a buffer zone that will limit the spread of malware and prevent hacked systems from accessing internal systems, so allowing DMZ systems to connect to systems in the LAN is inherently risky. It's safer to allow LAN systems to open connections to DMZ systems as it's hard to spread malware or hack systems through connections opened to a system. That doesn't mean you can't ever allow the DMZ to connect to the LAN, sometimes it is unavoidable, but it should be as little as possible.
In addition to @GdD's answer, some connections have to be opened from the DMZ to the LAN, for example a web server connection to an application or database server.
The user clicks a button on the website which triggers a database lookup to return some information.
As allowing connections to be made out of the DMZ is a higher risk (an attacker who compromises the server in the DMZ can start to abuse connections) what you do is place controls over what these connections can do. In this case you would use a firewall to limit the connection to one specific port and to the specific IP address of the database server, and the server itself would be configured to only run a short list of stored procedures which have already been vetted for risk.
Because the DMZ is a high risk zone, the architecture you use should be appropriate for what you wish to use it for. Have a look at this question on DMZ best practice for examples.
