Network and Perimeter Security
Network and perimeter security covers how traffic is separated, inspected and controlled between zones of differing trust. The exam focuses on segmentation logic, firewall rule evaluation, inspection placement, and the shift from a hard perimeter to identity-aware microsegmentation.
Segmentation and zones
- Place internet-facing services in a DMZ on a separate subnet from internal data stores. The DMZ may reach the internet and a limited set of internal services, never the reverse.
- VLANs alone are not a boundary; enforcement needs ACLs, security groups or host firewalls wherever routing permits inter-VLAN traffic.
- East-west controls matter: lateral movement inside a flat network is the typical ransomware path, which is why per-workload microsegmentation exists.
Filtering and inspection
- Stateful firewalls track connection state. Rules are evaluated top-down, first match wins, with an implicit deny at the end, so specific rules must sit above general ones.
- Next-generation firewalls add application awareness and TLS inspection, which breaks certificate pinning and requires a privacy and legal decision before enabling.
- IDS detects and alerts; IPS blocks inline. Placement determines visibility: a SPAN port only sees traffic the switch forwards, and inline encryption hides payload.
- A WAF protects HTTP applications using signatures and positive security models; it is not a substitute for secure code.
Remote access and zero trust
IPsec VPNs serve site-to-site and full-tunnel remote access; TLS client VPNs and ZTNA give per-application access with device posture checks. 802.1X with network access control authenticates devices before assigning a production VLAN.
Worked example
A rule set permits any-to-any from the internal range above a deny rule protecting a database subnet. Because firewalls evaluate top-down, the deny never fires. The fix is to move the deny above the permissive rule, scope the permissive rule to required destinations and ports, enable logging on denies, then verify with a port scan from a user subnet. Verification matters: rule order errors are invisible in the configuration text but obvious in a scan.
Traps
- Assuming a lower deny rule blocks traffic above it.
- Forgetting stateful return traffic when writing rules.
- Treating NAT as a security control.
- Declaring segmentation complete without host-level enforcement.