I85PREP
⌘ K
NISP Level 1 - Security Operations study materials
NISP Level 1 - Security Operations study resources

NISP Level 1 - Security Operations: Network Security and Perimeter Defense

NISP Level 1 - Security Operations · Work through your exam, one topic at a time.

All guide sections

Network Security and Perimeter Defense

This domain tests perimeter architecture and the device behaviour that makes segmentation real. Questions tend to be scenario-based: where a host belongs, which rule is needed, and what a given protocol actually protects.

Segmentation and zones

Design from the data outwards. Internet-facing services sit in a DMZ on their own subnet; databases and domain controllers sit in an internal zone that accepts no inbound internet traffic. East-west traffic between zones is filtered, not implicitly trusted - the zero-trust principle. VLANs give logical separation, but VLAN hopping and ARP spoofing mean they are not a security boundary alone; pair them with private VLANs, dynamic ARP inspection and 802.1X/NAC.

Perimeter devices

  • Packet-filter firewall - five-tuple rules, stateless.
  • Stateful firewall - tracks connections; return traffic is allowed by the state table.
  • Proxy/ALG - terminates and inspects at layer 7.
  • NGFW - adds application identification, IPS and TLS inspection.
  • IDS - passive copy of traffic, alerts only; IPS - inline, can block.
  • WAF - protects HTTP applications from injection, XSS and bots.

VPN and perimeter cryptography

IPsec AH provides integrity and authentication only; ESP adds confidentiality. Transport mode protects the payload host-to-host; tunnel mode wraps the whole packet and is used site-to-site. TLS VPNs are easier to run through NAT for remote access. Prefer IKEv2 with strong suites and perfect forward secrecy.

Worked example

A new public web application must reach an internal database. Put the web tier in the DMZ, allow 443 from the internet to the web tier only, allow the specific database port from the web subnet to the database host, deny and log everything else. Publishing the database directly to the internet to simplify the design breaks segmentation and will be raised as a boundary finding in an MLPS assessment.

Traps

  • Believing AH encrypts traffic - it does not.
  • Deploying an IPS out of band and expecting it to block.
  • Treating NAT as a security control.
  • Leaving a temporary any-any rule in place after troubleshooting.