Network and Perimeter Security
Network and Perimeter Security tests whether you can enforce least-privilege communication between zones and the internet. GCT-2A-324 expects you to distinguish firewall, IDS/IPS, WAF, VPN, and zero-trust access functions, and to design a DMZ that exposes only what must be exposed.
Core rules and concepts
- Default deny inbound and restrict outbound egress. Rules should specify source, destination, port, protocol, and purpose; “any/any” rules defeat segmentation.
- Stateful firewalls track connection state; stateless ACLs evaluate each packet independently. Next-generation firewalls add application awareness and threat inspection.
- IDS detects and alerts; IPS can block inline. A WAF protects HTTP applications from injection, cross-site scripting, and similar attacks but does not replace application authentication or authorization.
- Segmentation limits lateral movement using VLANs, subnets, security groups, and microsegmentation. A DMZ isolates internet-facing services from internal systems.
- VPNs create encrypted tunnels but can create flat trusted access. ZTNA applies per-application, identity-aware access instead of broad network trust. NAC controls device admission; DNS filtering and DDoS protection address separate threats.
Worked example
A partner must call a new order-status API. The design exposes only the API endpoint through a WAF in a DMZ, requires mutual TLS so both sides authenticate, and restricts the firewall rule to the partner’s published source ranges and TCP 443. The API tier can reach only a read-only database replica on a specific port. Logs from the WAF, mTLS gateway, and API are correlated. The reasoning: each layer answers a different question - who is calling, whether the request is acceptable HTTP, and whether the API can reach data. Opening a VPN into the whole internal network would grant far more than the task requires.
Traps that cost marks
- Using a WAF as a substitute for authentication or secure code.
- Believing an encrypted VPN implies a trusted user or device.
- Confusing IDS with IPS, or placing an IPS where it cannot see the traffic.
- Permitting broad egress that enables command-and-control and data exfiltration.