Network and Perimeter Security
Be fluent in the layers you will be asked to place a control at: physical/data link (802.1X, MAC filtering, VLANs), network (IPsec, routing, ACLs), transport (TLS, port filtering), application (WAF, proxies, DNS filtering). Perimeter design is now about segmentation rather than a single edge: DMZs for internet-facing services, internal zones by sensitivity, micro-segmentation and zero trust for east-west traffic.
Firewall families: packet-filtering (stateless, header only), stateful inspection (tracks sessions), application-layer/proxy (inspects payload, breaks the connection), and next-generation (application awareness, IPS, TLS inspection). A WAF protects web applications specifically. IDS detects and alerts; IPS sits inline and blocks - placement matters, and encrypted traffic must be decrypted at a controlled break point if payload inspection is required.
VPN and remote access: IPsec in transport mode (host-to-host) versus tunnel mode (gateway-to-gateway); ESP offers confidentiality, integrity and authentication, while AH offers integrity and authentication only. TLS-based VPNs are common for client access. Also know NAT/PAT, NAC for endpoint posture checks, 802.1X for port-level authentication, wireless security (WPA3 with SAE, WPA2-Enterprise with 802.1X/RADIUS; WEP and WPA-TKIP are broken), and DNS protections such as DNSSEC, DoH and response policy zones.
Availability controls: DDoS scrubbing, rate limiting, load balancing, redundant links and diverse routing.
Traps: AH does not encrypt; a firewall rule that "permits any/any" defeats segmentation; IDS does not stop attacks; NAC authenticates devices before network access and is not the same as 802.1X, though they often work together. "Air gap" questions still expect removable-media and supply-chain controls.
Worked example: a public web app needs a database. Put the web tier in the DMZ, the database in an internal zone, allow only the web tier's IP on the database port, inspect inbound HTTP at a WAF, and log the deny-all default on both boundaries.