I85PREP
⌘ K
CNCDP study materials
CNCDP study resources

CNCDP: Network Security Architecture and Design

CNCDP · Work through your exam, one topic at a time.

All guide sections

Network Security Architecture and Design

Network Security Architecture and Design

This domain tests whether you can convert business and threat requirements into a layered topology and justify every control placement. Items typically hand you a scenario - a public web application, a branch office, an OT plant - and ask which design preserves least privilege and defense in depth without breaking availability.

What a defensible design must achieve

  • Trust boundaries: every change in data sensitivity or user population needs an enforcing device - router ACL, firewall, proxy, or cloud security group.
  • Defense in depth: independent controls at several layers, so one failed appliance is not fatal. Do not concentrate all filtering in a single choke point.
  • Deny by default, least privilege: each rule set ends in an explicit deny; permit only the source/destination/port triples the application truly uses. Remember return traffic and ephemeral ports.
  • Zero trust (NIST SP 800-207): trust is never granted from network location alone. A policy decision point evaluates identity, device posture and context; a policy enforcement point sits in front of the resource.
  • Segmentation: VLANs separate broadcast domains but are not a security boundary by themselves (DTP/VLAN hopping, double tagging, misconfigured trunks). Enforce with inter-VLAN ACLs or a firewall. Microsegmentation pushes enforcement to the workload.
  • Inspection placement: inline IPS can drop; passive IDS or tap-based monitoring can only alert. Both belong behind the edge firewall, on segments that carry the traffic you must see.
  • Management plane separation: out-of-band management VLAN, jump host, MFA, and no administrative interface reachable from the internet.
  • Availability: HA pairs with session synchronization, redundant paths, and a documented fail-open vs fail-closed decision per asset value.
  • OT/ICS: keep Purdue-level separation with an IT/OT DMZ; never route plant-floor protocols directly to the internet.

Worked example

A retailer publishes a web shop backed by a database. Correct flow: internet → edge firewall permits TCP 443 only to a WAF in the DMZ → WAF forwards to the web tier → internal firewall permits TCP 1433 from the web server's address only, to a database in a protected zone with no default route to the internet → administrators reach all hosts through a jump host in the management VLAN with MFA → every device forwards logs to the SIEM. Reasoning: each boundary carries exactly one business-required flow, so a web-tier compromise yields one open port and no administrative path.

Traps that cost marks

  • Claiming a VLAN alone is segmentation - the exam wants enforced filtering.
  • Confusing IDS (detect) with IPS (prevent), or placing inspection where it cannot see the traffic.
  • Assuming zero trust eliminates perimeter controls; it changes the basis of trust, not the need for enforcement points.
  • Exposing management interfaces, hypervisor consoles, or backup servers to user networks.
  • Designing for confidentiality while ignoring the availability consequences of a fail-closed device.