Network Security
Core concepts
Understand the security zones and trust boundaries that shape a design: untrusted internet, DMZ, internal user, and management planes. Know stateful versus stateless filtering, ACL direction and implicit deny, NAT interactions with inspection, and the difference between authentication, authorization, and accounting. Be able to explain IPsec components (IKE phases, ESP, transport versus tunnel mode), 802.1X supplicant-authenticator-authentication server roles, and common segmentation approaches such as VLANs, VRFs, and security groups. Recognize first-hop and Layer 2 attacks (DHCP starvation, ARP spoofing, rogue RA) and their mitigations.
Traps in questions
Questions often ask which control mitigates a specific attack, and plausible-sounding but wrong pairings appear. Another trap is ACL ordering: a permit any placed before a deny makes the deny ineffective, and NAT can change which addresses an ACL matches depending on order of operations. Do not conflate encryption with integrity; ESP can provide both, but AH provides integrity only and no confidentiality.
Worked rule of thumb
Apply least privilege at the narrowest scope. Example: to permit a single web server to reach a database, write a rule matching the specific source host, destination host, and TCP port 5432, place it above broader rules, and log denials at the end. Verify with a flow test in both directions, remembering that stateful firewalls permit return traffic without an explicit rule.
Practical guidance
Treat the management plane as its own zone with out-of-band access, strong authentication, and logging. Ask what an attacker gains if a control fails, and prefer layered controls over a single strong one.