I85PREP
⌘ K
DCNP study materials
DCNP study resources

DCNP: Network Security and Segmentation

DCNP · Work through your exam, one topic at a time.

All guide sections

Network Security and Segmentation

Domain 4 tests how you stop lateral movement inside the data center. Expect questions on segmentation models, access control placement, first-hop security, and encryption, plus scenarios where a rule looks correct but fails because of direction, state, or asymmetry.

Segmentation layers

  • VLAN and VRF segmentation gives coarse isolation; microsegmentation applies per-workload policy using security groups or a distributed firewall.
  • Zero trust assumes the internal network is hostile: authenticate and authorize every flow rather than trusting a subnet.
  • Inter-VRF traffic must pass a stateful firewall or policy device; a router ACL alone cannot track sessions.

First-hop and control-plane hardening

  • DHCP snooping blocks rogue DHCP servers; dynamic ARP inspection validates ARP against the binding table.
  • BPDU guard and root guard protect the spanning-tree topology on host ports.
  • Control plane policing rate-limits traffic destined to the CPU, such as ARP, ICMP, and routing updates.
  • MACsec encrypts hop-by-hop on Ethernet links; IPsec protects traffic across untrusted transport.

Worked example

A policy requires that web tier 10.10.1.0/24 may reach database tier 10.10.2.0/24 on TCP 1433, and nothing else may cross. Place a stateful firewall between the VRFs, permit TCP 1433 from web to database, permit return traffic via state, then deny all. If you instead place a stateless ACL on the leaf, you must also permit the return direction (database high ports to web). Miss that and connections open but never complete. If traffic is routed asymmetrically through two firewalls, the state table never sees both directions and the session is dropped.

Traps that cost marks

  • Forgetting the implicit deny at the end of an ACL, or placing the deny before the permit.
  • Applying an ACL in the wrong direction or on the wrong interface.
  • Expecting a stateless ACL to handle return traffic.
  • Ignoring VLAN hopping via native VLAN or double tagging on trunk ports.
  • Leaving management and control-plane traffic unprotected while hardening data traffic.