Communication and Network Security
Communication and Network Security tests protocol-level correctness, segmentation, and control placement. Items ask where a control sits, what a protocol actually protects, or which rule set can express a requirement - often with one distractor that sounds stronger than the correct answer.
Layer-to-control mapping
Layer 2 brings VLANs, ARP spoofing, and port security. Layer 3 brings routing, IPsec, and network ACLs. Layer 4 brings TCP/UDP and stateful filtering. Layer 7 brings proxies, WAFs, and content inspection. Naming the layer usually eliminates two options immediately.
Protocol specifics
- IPsec tunnel mode protects gateway-to-gateway traffic; transport mode protects host-to-host. AH provides integrity and authentication only; ESP provides confidentiality plus integrity. IKE negotiates keys.
- TLS depends on certificate validation; forward secrecy limits the value of a stolen long-term key; certificate pinning resists mis-issuance but complicates rotation.
- DNSSEC signs records for integrity and authenticity but encrypts nothing; DoH and DoT provide confidentiality of queries.
- WPA3 uses SAE to resist offline dictionary attacks; 802.1X with EAP controls port-based access.
Segmentation and filtering
DMZs isolate internet-facing services. Microsegmentation and zero-trust network access replace flat VPN access with per-application authorisation. Security groups are stateful, instance-level, allow-only rule sets; network ACLs are stateless, subnet-level, evaluated in order, and support explicit deny. IDS is passive on a tap; IPS sits inline. A WAF protects HTTP semantics, not the network.
Worked example
A web tier in a cloud VPC must reach a database on port 5432 only, a known bad CIDR must be denied, and administrators may use SSH only through a bastion. Apply a security group on the database allowing 5432 from the web tier's security group - stateful, so no return rule is needed. Use a network ACL for the coarse subnet-level denial of the bad CIDR, because security groups cannot express deny. Restrict SSH with a security group allowing port 22 from the bastion group, and further narrow it at the NACL. Remember NACLs are stateless, so ephemeral return ports must be permitted explicitly. The reasoning: match rule capability and scope to the requirement.
Traps that cost marks
- Forgetting stateless NACL return traffic on ephemeral ports.
- Believing DNSSEC encrypts queries.
- Expecting AH to provide confidentiality.
- Equating a VPN with zero trust.
- Writing firewall rules that are never reviewed or tested.