I85PREP
⌘ K
NISP Level 2 study materials
NISP Level 2 study resources

NISP Level 2: Network Security

NISP Level 2 · Work through your exam, one topic at a time.

All guide sections

Network Security

Network Security tests whether you can reason about packets, paths and perimeters: how TCP/IP behaves, where each control sits, and what that control can actually see and stop. Expect questions that show a topology description or a rule list and ask what happens next.

Protocol facts examiners rely on

  • TCP handshake is SYN → SYN/ACK → ACK; UDP is connectionless and easy to spoof.
  • ARP has no authentication and is broadcast-based, so ARP spoofing enables man-in-the-middle on the local segment.
  • Classic LAN attacks include DNS cache poisoning, DHCP starvation, and VLAN hopping via double tagging or switch spoofing.
  • IPSec: AH gives integrity and origin authentication but no confidentiality; ESP adds encryption. Transport mode protects the payload; tunnel mode protects the entire original packet and is used for site-to-site VPNs.

Control placement

  • Packet-filter firewall - L3/L4 only, stateless, fast, no session awareness.
  • Stateful firewall - tracks sessions and permits return traffic automatically.
  • Proxy / WAF - understands HTTP and can block injection and cross-site scripting.
  • IDS detects and alerts, usually from a mirrored port; IPS sits inline and can drop. An IDS fed by a SPAN port cannot block anything.
  • DMZ - public-facing servers separated from the internal LAN by two filtering points, both default-deny.
  • Rules are evaluated top-down and the first match wins, with an implicit deny at the end; ordering therefore changes behaviour.

Worked example

An administrator writes permit tcp any host 10.0.0.5 eq 80, then deny tcp any host 10.0.0.5 eq 80. The deny never fires, because the permit is evaluated first. Reordering the rules, or narrowing the permit to one source subnet, restores the intended policy. The reasoning is first-match semantics - not "most specific rule wins".

Traps

  • Claiming AH encrypts traffic; only ESP provides confidentiality.
  • Believing a stateful firewall inspects application payloads.
  • Expecting a tap-mode IPS to block attacks.
  • Forgetting NAT breaks inbound sessions and complicates IPSec without NAT-T.
  • Treating a VLAN as a security boundary; hopping and misconfiguration defeat it, so disable unused ports and use private VLANs.