Communication and Network Security
Follow the layer
OSI questions reward locating the failure first: cabling (1), MAC/ARP/VLAN (2), IP/routing (3), TCP/UDP ports (4), sessions (5), TLS and encoding (6), applications (7). A switch is layer 2, a router layer 3, a next-generation firewall commonly inspects at 3, 4, and 7.
Protocols and design
Know where each protocol belongs: TLS for transport confidentiality, IPsec (AH for integrity, ESP for confidentiality) for VPNs, SSH for management, DNSSEC for authenticity but not confidentiality, S/MIME for email. Segmentation through VLANs, subnets, and DMZs limits blast radius; microsegmentation does the same in cloud. Zero trust replaces a trusted-inside assumption with strong identity and per-request authorization.
Detection
IDS is passive and out of band; IPS is inline and can block. Both use signature and anomaly methods. Honeypots divert and observe; SIEM correlates. Understand ARP spoofing, MAC flooding, VLAN hopping, DNS poisoning, DDoS, and on-path attacks, plus their fixes: port security, DHCP snooping, dynamic ARP inspection, DNSSEC, and 802.1X.
Wireless
WEP is broken; WPA2/CCMP is the baseline; WPA3 adds SAE against offline dictionary attacks. Enterprise mode with 802.1X and RADIUS authenticates users individually, while PSK shares one secret. Rogue APs and evil twins are detection problems, not encryption problems.
Rule of thumb
Name the layer where the evidence lives, then choose a control at that layer. VLAN hopping is a layer 2 misconfiguration, so the remedy is disabling trunk negotiation and using a dedicated native VLAN - not a new firewall rule.