Network Security Basics
Domain 2 tests how packets actually travel and where controls sit along the path. L1 items ask you to read a small topology, name the protocol or port behind a service, or pick the control that matches a stated risk.
Protocols and ports worth memorising
- TCP is connection-oriented (SYN, SYN/ACK, ACK handshake) and used where delivery must be guaranteed; UDP is connectionless and carries DNS queries, VoIP, streaming and many reflection attacks.
- Common ports: 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 445 SMB, 3389 RDP. Telnet and plain HTTP carry credentials in clear text, which is the standard contrast with SSH and HTTPS.
Segmentation and perimeter controls
- A packet-filter firewall matches addresses, ports and protocol; a stateful firewall tracks connection state and permits return traffic; a WAF or proxy inspects application content.
- Rules are evaluated top-down and end in an implicit default deny, so a permit-any rule placed above a deny rule wins.
- A DMZ holds internet-facing servers, reachable from outside with only limited access inward. NAT hides internal addressing but is not itself a security control. VLANs split broadcast domains and slow lateral movement, yet traffic between segments still needs firewall rules.
- An IDS alerts; an IPS can drop inline. Neither inspects inside TLS without decryption.
Attacks to recognise
ARP spoofing enables LAN man-in-the-middle; SYN floods exhaust the connection table; DNS cache poisoning redirects users to attacker hosts; rogue access points and WPS-enabled WPA2-PSK networks are common wireless weaknesses, while WPA2/WPA3-Enterprise with 802.1X issues per-user credentials instead of a shared key.
Worked example
A public web server must accept HTTPS from anyone and SSH only from the admin subnet 10.10.5.0/24; its database must be reachable only from that web server. Write the intent. Reasoning: inbound internet rules permit TCP 443 from any, permit TCP 22 from 10.10.5.0/24, deny everything else. The server goes in the DMZ. On the database host, allow TCP 3306 from the single web server address and deny the rest. The key point is that internal is not automatically trusted: the DMZ-to-LAN path is exactly what an attacker uses after compromising the web application.
Traps that cost marks
- Confusing IDS and IPS, or expecting a firewall to stop a virus inside permitted HTTPS.
- Believing MAC address filtering or a hidden SSID secures a wireless network.
- Forgetting the implicit deny, or placing a broad permit above a specific deny.
- Assuming a DMZ host can freely reach the internal LAN.