Networking and Cloud Security Concepts
Layers you can name
The OSI and TCP/IP models let you place a control: cabling and locks (layer 1), switches and MAC filtering (2), routing, IPsec and NAT (3), TCP/UDP ports (4), TLS (5-6), and applications such as HTTP, DNS and SMTP (7). Know the common ports - 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 3389 RDP - and always prefer the secure twin: SSH over Telnet, HTTPS over HTTP, SFTP over FTP, IPsec or TLS over cleartext.
Devices and segmentation
A firewall filters by rule; a WAF shields a web application; IDS detects and alerts while IPS blocks inline; a proxy brokers and logs traffic. Segmentation - VLANs, subnets, a DMZ for internet-facing systems and cloud micro-segmentation - limits lateral movement. For wireless use WPA2/WPA3 with AES, disable WPS, and watch for rogue access points and evil twins. "It is internal, so it is safe" is never true; zero trust replaces that assumption with continuous verification, delivered for remote users by ZTNA and SASE.
Cloud
Service models: IaaS (you manage OS and up), PaaS (you manage app and data), SaaS (you manage users and data). Deployment models: public, private, hybrid, community. The shared responsibility model is the most tested idea: the provider secures the facility, hardware and hypervisor; the customer always remains responsible for its data, identities and access configuration, in every model. CASB brokers SaaS use; CSPM hunts misconfiguration.
Rule of thumb
Asked who is responsible in the cloud, answer "the customer" for data, accounts and configuration, and "the provider" for the physical layer and underlying infrastructure. Encryption in transit means TLS; at rest means disk or object encryption with key management.