Network Security
Network Security
This domain tests segmentation decisions, where security devices sit in the traffic path, protocol selection, and how wireless and remote users are authenticated. Questions usually hinge on the operational consequence of a placement choice, not on the device's marketing category.
Segmentation and zoning
VLANs separate broadcast domains at Layer 2; ACLs and firewalls enforce policy between them at Layers 3–4. A DMZ hosts internet-facing services with no direct path to internal databases - the web tier talks to the app tier, never straight to the data tier. Microsegmentation pushes policy down to the workload (security group, host firewall, service mesh) so that lateral movement inside a subnet is limited. NAT translates addresses; it is obfuscation, not an access control.
Devices and placement
- Stateless packet filter: 5-tuple only, no session awareness, so it cannot safely allow return traffic dynamically.
- Stateful firewall: tracks flows and permits established-session return traffic; its session table is itself a denial-of-service target.
- NGFW: adds application identification, intrusion prevention, and TLS inspection.
- WAF: HTTP/S layer, protects applications from injection and OWASP-class attacks that a network firewall cannot see.
- IDS: passive, receives a copy via SPAN or TAP, alerts only. IPS: inline, can drop, and must be sized for latency and for its failure mode.
- Proxy: terminates client connections, enabling URL filtering and content inspection.
Protocols and ports
SSH 22, DNS 53, HTTPS 443, LDAPS 636, RDP 3389, syslog 514 (6514 over TLS). Prefer SSH over Telnet, SFTP over FTP, HTTPS over HTTP, LDAPS over LDAP. IPsec: AH provides integrity and origin authentication only; ESP provides confidentiality plus integrity. TLS inspection breaks certificate pinning unless clients trust the inspection CA.
Wireless and access control
WPA3 uses SAE, a handshake resistant to offline dictionary attacks, and in enterprise mode pairs with 802.1X/EAP against a RADIUS server. 802.1X is port-based network access control that authenticates a device or user before granting Layer 2 access - it is not a VPN and provides no tunneling. NAC adds endpoint posture checks. Split tunneling saves bandwidth but exposes the endpoint's traffic to the local network.
Worked example
"An IPS must block exploit traffic to a public web server without breaking legitimate large uploads." Place the IPS inline in front of the server, tune an exception for the upload endpoint, and add a WAF rule for the application payload. A SPAN-connected sensor could only have alerted, and a stateless filter would have passed the payload regardless.
Traps
AH does not encrypt. 802.1X is not a tunneling protocol. A firewall rule permitting "any/any" in the DMZ defeats the zoning design.