Network Architecture and Security Fundamentals
What to know cold
The candidate must be fluent in the OSI and TCP/IP models and be able to place any control at the right layer. Understand segmentation and zoning (DMZ, internal, management planes), the difference between a stateful firewall and a stateless ACL, and where a WAF, IPS, and proxy each sit. Know the behaviour of NAT, VLANs, and routing, plus how TLS protects confidentiality and integrity but not endpoint trust. Familiarity with common attack mechanics - spoofing, ARP poisoning, on-path interception, SYN floods, DNS cache poisoning, and lateral movement - is assumed.
Traps that show up in questions
- Confusing authentication with authorisation, or encryption with integrity: TLS gives both, but hashing alone gives neither confidentiality nor authenticity.
- Treating a DMZ as a trust boundary that removes the need for host hardening.
- Assuming a stateful firewall inspects application payloads; it does not - that is the IPS/WAF role.
- Picking "defence in depth" as an answer when the scenario asks for a single compensating control for a specific gap.
- Forgetting that segmentation limits blast radius but does not stop an attacker who has already compromised a host inside the segment.
Rule of thumb
Map every proposed control to a layer and a threat before choosing it. If a stem describes an attack on content (SQL injection, XSS), the answer is at Layer 7; if it describes an attack on connections (SYN flood, spoofing), the answer is at Layer 3/4.
Worked example
A web application faces injection attacks from the internet. A network ACL blocks ports, a stateful firewall tracks sessions, and a WAF inspects HTTP. Only the WAF addresses the stated threat, because the attack uses allowed ports and valid sessions. The others are still useful for depth, but the primary control is the WAF.