Network Defense Fundamentals
This domain tests whether you can reason about defense as an engineering discipline rather than a product list. Expect questions on control classification, segmentation, trust boundaries, and how risk is expressed and reduced.
Core rules
- CIA is the yardstick. Every control you propose must be tied to confidentiality, integrity, or availability, and you should be able to name the trade-off it creates.
- Controls have two axes. Category: preventive, detective, corrective, compensating, deterrent. Type: technical, administrative, physical. A question asking "what kind of control is this?" usually wants both.
- Least privilege and need-to-know apply to users, service accounts, applications, and network paths equally.
- Segmentation creates trust boundaries. Traffic crossing a boundary should be explicitly permitted, inspected, and logged; everything else is default-deny.
- Risk = likelihood x impact, expressed against a specific asset and threat. Residual risk remains after controls are applied, and someone must accept it formally.
- Baselines make "abnormal" measurable. Without a documented hardened configuration or traffic baseline, detection has no reference point.
Worked example
A legacy inventory application cannot be patched and runs SMBv1 on a flat /24 shared with workstations. What do you do?
Reasoning: the vulnerability cannot be removed, so you reduce exposure rather than the likelihood of exploitation directly. Move the server into its own VLAN, allow SMB only from the two application servers that need it, deny workstation-to-workstation SMB, and add IDS signatures for known SMB exploits plus file-integrity monitoring on the host. That is a preventive technical control (segmentation and ACL), a detective control (IDS and FIM), and an administrative control (documented risk acceptance). You did not fix the vulnerability; you lowered residual risk to a level the business can accept, and you logged the decision.
Traps that cost marks
- Labelling antivirus "corrective" - it is preventive; quarantine and reimaging are corrective.
- Assuming encryption improves availability. It usually trades against it through key loss or CPU cost.
- Treating NAT as a security control. It is an addressing mechanism; the firewall policy is the control.
- Forgetting that compensating controls require documented acceptance and periodic review, not just a workaround.
- Answering "defense in depth" to every question. Items usually want the specific layer or control.