Network Security and Perimeter Defense
Domain 2 covers perimeter and internal network controls: firewalls, DMZs, IDS/IPS, VPNs, segmentation, and zero-trust thinking. The exam favors design reasoning over product names.
Core rules and concepts
- Default deny: permit only required traffic, then log it.
- A DMZ buffers internet-facing services from internal systems. Web servers belong there; databases usually do not.
- Stateful firewalls track connections; stateless ACLs filter per packet. Neither inspects application payloads like a WAF.
- IDS detects and alerts; IPS sits inline and can block. Placing IPS in monitor-only mode weakens prevention but preserves evidence.
- Segmentation limits lateral movement. VLANs are not a security boundary unless routing and ACLs enforce policy.
- VPNs encrypt traffic over untrusted networks and authenticate endpoints/users; they do not replace endpoint security.
Worked example
A public web app needs HTTPS. Design: allow 443 from internet to the DMZ web server; allow the web server to reach the internal database only on its port, only from that server; deny all else; log denies. Put the WAF in front of the web server and an IDS on the DMZ segment. Reasoning: exposure is minimized, the database is not directly reachable, and monitoring covers both north-south and east-west traffic.
Traps that cost marks
An IDS does not block by default. A firewall is not an antivirus. 'Zero trust' does not mean no firewall; it means verify explicitly and assume breach. Encrypting with a VPN does not make a compromised endpoint trustworthy.