Network Security Fundamentals
This domain tests the vocabulary of security plus the practical controls a junior administrator configures: ACLs, segmentation, authentication, and hardening.
Core principles
CIA: confidentiality, integrity, availability. AAA: authentication (who you are), authorisation (what you may do), accounting (what you did). Layer defences: least privilege, defence in depth, separation of duties, segmentation. A DMZ holds public-facing servers away from the internal LAN.
Controls and devices
Firewalls range from stateless packet filters to stateful inspection to next-generation firewalls that identify applications and users. A WAF protects web applications specifically. ACLs are evaluated top-down and end with an implicit deny; standard ACLs filter on source only, extended ACLs on source, destination, protocol, and port. VPNs use IPsec for site-to-site links or TLS for client remote access. 802.1X/NAC controls who gets on a switch port; port security limits MAC addresses per port.
Threats to recognise
Phishing and social engineering, malware and ransomware, DoS/DDoS, on-path attacks via ARP spoofing, rogue DHCP servers, rogue access points, VLAN hopping, credential brute force, and insider misuse. Controls include MFA, patching, disabling unused services and ports, strong password policy, centralised logging, and user awareness training.
Worked example
Only hosts in 10.0.0.0/24 may reach server 192.168.5.10 on HTTPS. Write an extended ACL permitting tcp 10.0.0.0 0.0.0.255 host 192.168.5.10 eq 443, then apply it inbound on the interface closest to the source. Remember the implicit deny blocks everything else, and that a stateful firewall handles the return traffic for you.
Traps
Forgetting the implicit deny and locking yourself out. Applying an ACL in the wrong direction or on the wrong interface. Confusing authentication with authorisation. Believing encryption alone provides integrity or freshness, or that NAT is a security boundary.