Network Security Architecture and Segmentation
This domain tests whether you can turn a data flow into zones and enforcement points, then defend the segmentation you drew. Expect questions on zone design, east-west traffic, microsegmentation, ZTNA, and inspection trade-offs.
Zones and trust boundaries
Design from the data flow, not the org chart. Typical zones: internet edge, DMZ, application, data, management, partner. Every boundary needs a policy enforcement point, default-deny rules, and documented permitted flows. North-south traffic is client-to-datacenter; east-west is server-to-server, and it is where flat networks fail.
Enforcement mechanisms
VLANs with Layer 3 ACLs (VLAN hopping via trunk abuse and double tagging means Layer 2 alone is not a boundary), VRFs for routing separation, stateful firewalls, NGFWs with application awareness, cloud security groups, host firewalls, and microsegmentation tied to workload identity. Overlay networks (VXLAN) hide traffic from the underlay, so distributed firewalls are required. Service-mesh mTLS supplies workload identity but does not replace network policy.
Edge access control
802.1X for wired and wireless NAC; MAC authentication bypass is a fallback with spoofable identity. ZTNA replaces broad VPN access with per-application, per-identity access. SASE/SSE consolidates secure web gateway, CASB, ZTNA, and firewall-as-a-service.
Inspection
Place IDS/IPS where the traffic it must inspect actually flows. Filter egress and control DNS - command and control often rides DNS. TLS inspection breaks certificate pinning and raises privacy and legal issues, so scope it to specific destinations rather than everywhere.
Worked example
PCI cardholder data sits on three application servers and one database. Reasoning: place them in a dedicated VRF and VLAN; allow only app-to-db on the database port, log collector to log store, and administration through a jump host with MFA; allow no inbound internet path. Document the flows and test segmentation at least annually and after any change (PCI DSS 11.4.5). "It is on the internal network" is not a control - insiders and lateral movement defeat flat trust.
Traps
- Any-any management rules.
- Assuming cloud security groups cover on-premises paths.
- Treating VLANs as a boundary without ACLs.
- Missing egress filtering.
- Assuming an air gap that a maintenance link quietly bridges.
- Blanket TLS inspection that breaks pinned applications.
- Forgetting IPv6 paths.