Basic Network Security Concepts: Layering, Perimeter Controls, and Attack Patterns
Layers and ports
Know the layering well enough to say where a control acts: VLANs and switching at Layer 2, IP, ACLs and routing at Layer 3, TCP/UDP ports at Layer 4, TLS and HTTP at Layers 5–7. Ports worth memorizing: 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 445 SMB, 161 SNMP, 3389 RDP. Questions often pair a legacy insecure protocol with its replacement: Telnet→SSH, FTP→SFTP/FTPS, HTTP→HTTPS, SNMPv1/v2c→SNMPv3, TFTP→SCP.
Perimeter and internal controls
A stateless packet filter matches addresses and ports only. A stateful firewall tracks connections and permits return traffic automatically. A next-generation firewall inspects applications and users; a WAF protects a specific web application from injection and scripting attacks. An IDS detects and alerts but does not stop traffic; an IPS sits inline and blocks. Public-facing servers belong in a DMZ so a compromise there does not expose the internal LAN. VLANs and internal segmentation limit lateral movement; NAC decides whether a device may join the network at all; a proxy brokers and logs outbound web traffic; a VPN (IPsec or TLS) carries traffic safely across an untrusted network.
Attacks to recognize
On-path (MITM) attacks, ARP spoofing, DNS cache poisoning, VLAN hopping, IP/MAC/email spoofing, deauthentication and evil-twin wireless, and DDoS in volumetric (bandwidth flooding) and application-layer forms.
Traps
Don't confuse encryption fixes with segmentation fixes: encryption stops eavesdropping, not lateral movement. Don't treat a firewall as malware protection, or a WAF as a replacement for patching.
Rule of thumb
Deny by default at the boundary, encrypt sensitive data in transit, and segment so one compromised host cannot reach everything else. If an answer option says 'encrypt' for a lateral-movement question, it is usually the wrong choice.