Networks, connectivity and security
What this domain covers
Networking covers how devices communicate and how that communication is protected. Candidates should understand the OSI and TCP/IP models at a conceptual level, the roles of IP addressing (IPv4 and IPv6), subnet masks, DHCP, DNS, gateways and NAT, and the difference between LAN, WAN, WLAN, VPN and the internet. Know wired and wireless media, topologies, switches versus hubs versus routers, and the trade-offs of bandwidth, latency and reliability. Security concepts include the CIA triad (confidentiality, integrity, availability), authentication and authorisation, password and multi-factor practices, patching, firewalls, antivirus, encryption and backups.
Concepts to know
- Threats: malware, phishing, social engineering, ransomware, denial of service, insider threat, weak configuration.
- Controls: least privilege, access control lists, network segmentation, VPN for remote access, secure Wi-Fi (WPA2/WPA3), guest networks.
- Response: detect, contain, eradicate, recover, review; preserve evidence and report per policy.
- Wireless issues: interference, channel overlap, signal strength, roaming.
Traps
Examiners frequently test that a switch forwards within a LAN while a router connects networks, and that DNS resolves names while DHCP assigns addresses. Another trap is treating antivirus as sufficient protection; layered defence is expected. Do not confuse authentication (who you are) with authorisation (what you may do). In incident scenarios, disconnecting the infected machine before recording details can destroy evidence.
Worked example / rule of thumb
Rule of thumb: name the layer before naming the fix. If users can reach a server by IP address but not by name, the fault is name resolution, so check DNS. If they cannot reach it at all, check physical link, IP configuration and gateway in that order.
Study tip
For each security control, state the threat it mitigates. That pairing is what distinguishes a strong answer from a list of tools.