Security Pertaining to Networks and Physical Environments
Network and physical security questions ask how controls at Layers 1 through 7 and at the facility boundary work together. Expect scenarios on segmentation, firewalls, wireless, and data-center controls.
Core rules
- Segment by trust: internet-facing DMZ, internal user VLANs, management VLAN, server tiers, and sensitive enclaves. Use VLANs, subnets, ACLs, and security groups; segmentation limits lateral movement but does not replace host hardening.
- Firewalls: packet filters inspect headers; stateful firewalls track connections; next-generation firewalls add application awareness and IPS; WAFs protect HTTP applications. Default deny, explicit allow, and review rules regularly.
- IDS detects and alerts; IPS can block inline. Placement matters: network sensors see east-west traffic only if spans or taps cover it. NAC with 802.1X authenticates devices before network access.
- Wireless: WPA3-Enterprise with 802.1X and RADIUS for organizations; WPA2/WPA3-Personal uses a shared passphrase and suits home/small sites. Rogue APs and evil twins exploit users; use WIDS/WIPS, certificate validation, and 802.1X.
- Physical layers: perimeter barriers and lighting; access control vestibules (mantraps), badges plus PIN or biometrics, visitor escorts and logs; CCTV; locks. Fail-safe locks release on power loss for life safety; fail-secure locks stay locked and need alternative egress.
- Data center: fire detection and suppression matched to the space-water sprinklers are unsuitable near energized electronics; use pre-action or clean-agent systems. Control temperature, humidity, EMI, and cable access; provide UPS and generators; use hot/cold aisle containment.
Worked example
A web application in a DMZ must reach a database on the internal network. A sound rule set allows TCP 443 from the internet to the web server, allows the web server to reach only the database listener on TCP 1433, and denies everything else; administrators reach management interfaces through a bastion host or VPN. Reasoning: each rule states a required flow and its direction, and the database is never directly reachable from the internet.
Traps that cost marks
Confusing IDS with IPS; thinking encryption removes the need for segmentation; treating WPA2-Personal as enterprise-grade; specifying fail-secure locks on egress doors; and putting wet-pipe sprinklers over server racks.