Network Security and Architecture
Core ideas
Understand the OSI and TCP/IP models and where controls sit. Firewalls filter by stateful inspection or stateless rules; next-generation firewalls add application awareness. IDS detects and alerts; IPS detects and blocks. Placement matters: an inline IPS can block, a passive IDS cannot. Know network segmentation, VLANs, DMZs, and the concept of a screened subnet for public-facing services.
Protocols and protections
Learn how TLS protects data in transit and where VPNs (site-to-site and remote access) fit. Understand IPsec modes (transport vs tunnel), and the role of NAC in controlling device access. Wireless security should reference WPA2/WPA3 and the weakness of WEP. Be able to distinguish a man-in-the-middle attack from ARP spoofing (a technique that enables MITM) and from DNS poisoning.
Architecture concepts
Zero trust rejects implicit trust based on network location and verifies every request. Defense in depth layers perimeter, internal segmentation, and host controls. Redundancy and high availability support the availability leg of CIA. Cloud shared responsibility splits duties between provider and customer.
Traps in questions
A common trap is confusing IDS with IPS in a scenario where blocking is required. Another is assuming a VPN encrypts traffic to the internet when it only secures the tunnel to the endpoint. Watch for questions that describe segmentation but ask for the primary security benefit (limiting lateral movement).
Rule of thumb
Match the control to the requirement: if the question says "block" or "prevent," choose an inline/enforcing control; if it says "detect" or "alert," choose a monitoring control.