Network and Endpoint Security
Network and Endpoint Security
This domain covers the defensive controls at the network and host layers and how they complement each other.
Network controls: firewalls (stateful vs. stateless packet filters), NGFW with application awareness, IDS vs. IPS (detect vs. inline block), network segmentation and microsegmentation, VPN/ZTNA, DNS filtering, and proxy/web gateways. Understand defense in depth: no single control is sufficient.
Endpoint controls: EDR (behavioral detection, telemetry, response actions like isolate/kill), EPP/antivirus (signature-based prevention), application allowlisting, host firewalls, disk encryption, and patch management. Know that EDR focuses on behavior and response, while traditional AV focuses on known signatures.
Traps: treating IDS as blocking (it is passive); assuming a firewall stops malicious traffic over an allowed port (it does not inspect content unless it is an NGFW/proxy); believing encryption alone prevents data theft (it protects data at rest/in transit, not exfiltration via authorized channels); and confusing segmentation with isolation (segmentation allows controlled flows).
Rule of thumb: Preventive controls reduce likelihood; detective controls reduce dwell time; responsive controls reduce impact. Ask which category the question is really testing.
Worked example: Malware beacons out over HTTPS to a rare domain. A stateful firewall permits it because port 443 is allowed. The controls that would catch it are DNS filtering, TLS inspection/proxy, or EDR behavioral detection - not the port-based firewall rule.