Network Security Architecture and Design
Segmentation and Zones
Design around zones: internet/untrusted, DMZ, internal/trusted, and management. Understand segmentation (VLANs, subnets, microsegmentation), the principle of least privilege at the network layer, and why a DMZ isolates internet-facing services. Know north-south vs. east-west traffic and the role of a screened subnet.
Defense in Depth and Control Placement
Layer preventive, detective, and corrective controls. Know where firewalls, IDS/IPS, WAFs, proxies, and NAC sit, and what each can and cannot see. A stateful firewall tracks connections; a WAF inspects HTTP; a proxy brokers outbound traffic; NAC gates endpoint admission.
Architectures and Patterns
Understand VPN topologies (site-to-site vs. remote access), zero trust (verify explicitly, least privilege, assume breach), SD-WAN, and cloud shared-responsibility boundaries. Know the difference between a hub-and-spoke and mesh design, and the trade-offs of each.
Worked Example / Rule of Thumb
Place the control at the choke point where the traffic must pass. Example: to block SQL injection against a public web app, a WAF at the DMZ edge is appropriate; a network firewall alone cannot inspect application payloads. To limit lateral movement after compromise, choose microsegmentation over a single perimeter firewall.
Trap: 'more layers' is not always the answer - questions test whether a control can actually see the traffic it is meant to protect.