Network Security and Architecture
What this domain tests
This domain checks how you place controls on a topology: zoning and segmentation, firewall and IDS/IPS behaviour, secure remote access, wireless authentication, and the move from perimeter thinking to zero trust.
Core rules
- Zones: untrusted internet, DMZ/screened subnet for public-facing services, internal trusted zone, and a separate management network. Every inter-zone path passes a policy enforcement point.
- Firewalls: stateless packet filters match a five-tuple; stateful inspection tracks connection state; application-layer proxies and NGFWs inspect layer 7, including application identification and TLS break-and-inspect. Default deny, explicit allow, documented purpose per rule.
- IDS versus IPS: an IDS is passive (SPAN port or TAP), alerts only; an IPS sits inline and can drop. Place the IPS in the path of the traffic it must block.
- Segmentation: VLANs at layer 2, subnets and security groups at layer 3, microsegmentation for east-west traffic. A VLAN by itself is not a security boundary - you need filtering between segments.
- Remote access: IPsec ESP provides confidentiality plus integrity; AH provides integrity and authentication only, no encryption. TLS VPNs use 443 and traverse restrictive networks more easily.
- Wireless: 802.1X with EAP for enterprise authentication; WPA3-Enterprise for the strongest current option; WEP, WPA and TKIP are deprecated.
- Zero trust: authenticate and authorize each request, least privilege, assume breach, no implicit trust from network location.
Worked example
A three-tier web application: the load balancer sits in the DMZ, the application tier in a private subnet, the database in an isolated subnet with no internet route. Rules: internet to load balancer on 443 only; load balancer to app on 8080; app to database on 5432; administrators reach all tiers through a bastion with MFA. Reasoning: each rule names source, destination, port and purpose; everything not required is denied; because the database never accepts internet traffic, a web-tier exploit cannot reach it directly and lateral movement is constrained.
Traps that cost marks
- Expecting an IPS on one VLAN to inspect inter-VLAN traffic it never sees.
- Treating NAT as a security control - it is an address translation convenience.
- Confusing IPsec AH (integrity only) with ESP (encryption).
- Monitoring only north-south traffic and missing east-west lateral movement.
- Assuming a firewall rule with 'any' destination is acceptable because the port is restricted.