Network boundaries and protected communication
This domain tests perimeter architecture and the device behaviour that makes segmentation real. Questions tend to be scenario-based: where a host belongs, which rule is needed, and what a given protocol actually protects.
Segmentation and zones
Design from the data outwards. Internet-facing services sit in a DMZ on their own subnet; databases and domain controllers sit in an internal zone that accepts no inbound internet traffic. East-west traffic between zones is filtered, not implicitly trusted - the zero-trust principle. VLANs give logical separation, but VLAN hopping and ARP spoofing mean they are not a security boundary alone; apply suitable inter-zone filtering, access control and Layer 2 protections based on the threat model. Private VLANs, dynamic ARP inspection and 802.1 X/NAC address different risks and are not interchangeable requirements for every design.
Perimeter devices
- Packet-filter firewall - five-tuple rules, stateless.
- Stateful firewall - tracks connections; return traffic is allowed by the state table.
- Proxy/ALG - terminates and inspects at layer 7.
- NGFW - adds application identification, IPS and TLS inspection.
- IDS - passive copy of traffic, alerts only; IPS - inline, can block.
- WAF - protects HTTP applications from injection, XSS and bots.
VPN and perimeter cryptography
IPsec AH provides integrity and authentication only; ESP can provide payload confidentiality and integrity/authentication according to the negotiated transforms. Transport mode protects the payload host-to-host; tunnel mode wraps the whole packet and is used site-to-site. TLS VPNs are easier to run through NAT for remote access. Prefer IKEv 2 with strong suites and perfect forward secrecy.
Worked example
A new public web application must reach an internal database. Put the web tier in the DMZ, allow 443 from the internet to the web tier only, allow the specific database port from the web subnet to the database host, deny and log everything else. Publishing the database directly to the internet to simplify the design breaks segmentation and expands exposure; the actual assessment finding depends on the applicable requirements and evidence.
Traps
- Believing AH encrypts traffic - it does not.
- Deploying an IPS out of band and expecting it to block.
- Treating NAT as a security control.
- Leaving a temporary any-any rule in place after troubleshooting.