Network Security
Domain 2: Network Security
This domain tests secure network design and operation: segmentation, least-access firewall rules, intrusion detection and prevention, remote access, name resolution, wireless, and monitoring. Questions often ask you to choose the control that limits lateral movement without breaking the business flow.
Core rules and concepts
- Segment by trust and function: user, server, management, OT/IoT, and guest networks should not share a flat broadcast domain. Segmentation must be enforced by firewalls or security groups, not VLANs alone.
- Default deny: allow only required source, destination, port, and protocol; document each rule and review it. Egress filtering matters as much as ingress filtering.
- IDS detects and alerts; IPS can block inline. Placement determines visibility: tap or SPAN for IDS, inline for IPS.
- Remote access: VPNs protect transport, but authentication and authorization still decide access. Prefer MFA, device posture checks, and least-privilege split tunnels.
- DNS is a control point: protective DNS, DNSSEC validation, and logging help detect command-and-control and domain abuse.
- Wireless: use WPA3 or WPA2-Enterprise with 802.1X; separate guest traffic; do not rely on hidden SSIDs or MAC filtering as security.
Worked example
A public web application in a DMZ must reach a database. The current rule allows the web subnet to the database subnet on any port. You replace it with a rule permitting only the web server's security group to the database's private address on the database port, require TLS, and block direct internet access to the database. You enable flow logs and an IPS signature set for database exploits. Reasoning: the rule enforces least privilege at the workload level, preserves the required flow, and adds detection. A VLAN-only change would not filter traffic between hosts in routed networks.
Traps that cost marks
Do not treat a VPN as authorization. Do not place an IPS in monitor-only mode and claim prevention. Do not assume internal networks are trusted. Do not allow any-any rules for troubleshooting and leave them. Do not forget management-plane access and egress logging.