Network Security Fundamentals
What this domain tests
The Network Security Fundamentals domain checks whether you can reason about packet flow, trust boundaries, and control placement rather than reciting acronyms. Expect questions on TCP/IP layers, common ports, stateful vs stateless filtering, NAT, VPNs, proxies, segmentation, and the difference between detection and prevention.
Core rules
- Defense in depth: place controls at host, network, and application layers. A firewall alone does not stop phishing.
- Least privilege and default deny: allow only required flows; document the business need.
- Stateful inspection tracks sessions; ACL order matters because evaluation stops at the first match.
- Segmentation (VLANs, DMZs, security groups) limits lateral movement, but it is not a substitute for host controls.
- IDS detects and alerts; IPS can block. Inline IPS can drop traffic; passive IDS cannot.
- NAT/PAT hides addresses but is not a security control.
Worked example
A branch cannot reach a SaaS app over HTTPS. DNS resolves correctly, and the firewall shows TCP 443 SYN packets leaving but no SYN-ACK. Other sites work. Reasoning: the failure is at or beyond the firewall, not DNS. Check the outbound rule, NAT translation, and any SSL inspection or IPS policy. If the firewall blocks the TLS SNI or URL category, the SYN may be dropped before the server replies. Confirm by testing a known-allowed 443 destination from the same host, then compare policy hits. The fix is a scoped rule or category exception, not opening all outbound ports.
Traps
- Mixing up IDS and IPS.
- Forgetting return traffic and asymmetric routing.
- Assuming NAT provides protection.
- Ignoring ACL order and implicit deny.
- Treating 802.1X as merely a firewall feature.