Network and Infrastructure Security
What to know
Understand the OSI and TCP/IP models well enough to place controls: segmentation at Layer 2/3, filtering at Layer 3/4, and application-aware inspection at Layer 7. Know the difference between a stateful firewall, a stateless packet filter, a web application firewall, and a proxy. Understand network segmentation, microsegmentation, and zero trust - trust is not derived from network location.
Know the security implications of core protocols: DNS (spoofing, tunneling, cache poisoning), ARP (spoofing), DHCP (rogue servers), BGP (route hijacking), and TLS (certificate validation, version and cipher hygiene). Understand VPNs, IPsec modes, and the difference between transport and tunnel mode. Wireless security should be understood in terms of WPA2/WPA3 enterprise authentication versus pre-shared keys.
Defense in depth means layered controls: perimeter, internal segmentation, host firewalls, and monitoring. Network detection relies on flow data, packet capture, and IDS/IPS placement - an IDS detects, an IPS blocks inline. Understand DMZs, bastion hosts, jump servers, and egress filtering as controls against data exfiltration.
Traps
Questions often place an IPS where it cannot see traffic (asymmetric routing, encrypted flows) or expect a firewall to stop application-layer attacks. Another trap: a VLAN is segmentation, not a security boundary by itself if routing between VLANs is permissive. Beware claims that encryption replaces segmentation - it does not stop lateral movement by an authenticated attacker.
Worked example
A flat internal network lets ransomware spread from a workstation to a database server. The fix is not a bigger perimeter firewall but internal segmentation with deny-by-default rules between tiers, plus egress filtering so command-and-control traffic is blocked.
Rule of thumb: controls must sit where the traffic actually flows - verify placement before assuming detection.