Communication and Network Security
Core concepts
Know the OSI and TCP/IP models and which attacks map to which layer (e.g., ARP spoofing at Layer 2, IP spoofing at Layer 3, TLS at Layer 4-7). Understand core protocols and their security posture: TLS for transport confidentiality, IPsec (AH = integrity, ESP = confidentiality + integrity), and DNSSEC for origin authentication of DNS data (not confidentiality). Know network segmentation, VLANs, DMZs, and the principle that segmentation limits lateral movement.
Secure design
Understand firewalls (stateful vs stateless), proxies, IDS vs IPS (detect vs prevent), and the concept of defense in depth. Know secure network architectures: bastion hosts, jump boxes, and zero-trust micro-segmentation. Recognize wireless risks (WPA2/WPA3, rogue APs, evil twin) and that WEP is broken. Understand VPN types (site-to-site vs remote access) and that TLS/SSH protect management traffic.
Traps
Questions often confuse IDS with IPS - IDS detects and alerts, IPS blocks inline. Another trap: assuming DNSSEC encrypts DNS (it does not; it authenticates). Watch for IPsec questions where AH vs ESP is tested - AH does not encrypt. Also, a common error is treating a VLAN as a security boundary equivalent to a firewall; it is not.
Worked example
An attacker on the same subnet poisons ARP to intercept traffic. The correct mitigation is dynamic ARP inspection / port security at the switch (Layer 2), not a host firewall or TLS alone - because the attack is at Layer 2 and TLS would protect payloads only if properly validated end to end.