Network and Endpoint Security Operations
What to know
Operations questions test whether you can keep defenses running and detect what slips through. Know network zoning and segmentation, DMZ design, east-west traffic controls, and where inspection happens. Understand firewall types and rule hygiene, IDS versus IPS placement, and the limits of perimeter defense. Know secure remote access patterns: VPN versus zero-trust network access, and why least-privilege access beats flat network trust.
Endpoint concepts: EDR versus antivirus, application allowlisting, patch management, hardening baselines, and configuration drift. Understand logging and monitoring architecture: log sources, centralization, time synchronization, retention, and SIEM correlation with tuning to reduce false positives. Know DNS-layer controls, email security (SPF, DKIM, DMARC), and web filtering. Understand vulnerability and configuration scanning cadence, and how operational metrics (MTTD, MTTR, coverage) demonstrate effectiveness.
Traps
- Assuming segmentation alone stops lateral movement without monitoring.
- Confusing IDS (detect) with IPS (block), and misplacing them relative to encryption.
- Believing EDR replaces patching or allowlisting.
- Overlooking log retention and time sync, which break investigations.
Worked example / rule of thumb
Ransomware spreads across a flat VLAN. Correct response in design terms: microsegment critical systems, restrict SMB, enforce allowlisting, centralize logs, and alert on anomalous lateral authentication. Rule of thumb: detection without segmentation gives you alerts; segmentation without detection gives you blind spots; you need both.