Network Security and Perimeter Defense
Domain 2 - Network Security and Perimeter Defense
This domain covers segmentation, firewalls, IDS/IPS, VPNs, and the shift from a hard outer perimeter to zero-trust access. Questions often test rule order, default-deny design, and where a control sits in the path.
Core rules
- Firewalls evaluate rules top-down; the first match wins. Put specific allows above broad denies.
- Default deny inbound and outbound; permit only required ports, protocols, and destinations.
- A DMZ separates internet-facing services from internal networks. Segmentation and host firewalls limit east-west movement after compromise.
- Stateful firewalls track connections; stateless ACLs must permit return traffic explicitly.
- IDS detects and alerts; IPS can block inline. Neither replaces authentication or patching.
- VPNs encrypt transit and authenticate users, but they do not enforce least privilege by themselves.
Worked example
A web server in the DMZ must accept HTTPS from the internet and reach a database on TCP 5432. Rules: allow internet to web server TCP 443; allow web server to database TCP 5432; deny all other traffic. If an allow-any rule is placed first, later denies never match. Log denied traffic and review it for scanning or misconfiguration.
Traps
Saying the perimeter no longer matters; confusing IDS with IPS; assuming a VPN grants full internal access; and forgetting egress filtering, which lets beaconing succeed even when inbound is locked down.