Network security
Network security tests segmentation, inspection, and trust boundaries. Questions ask you to place a control where it actually sees traffic and to distinguish detection from prevention.
Core rules and concepts
- Segment networks by trust and function: a DMZ for externally reachable services, internal zones for users and data, and management networks for infrastructure. VLANs and security groups enforce separation; a flat network magnifies lateral movement.
- Firewalls filter by rule set. Stateful firewalls track connections; next-generation firewalls add application awareness and intrusion prevention. A WAF protects web applications at layer 7.
- IDS detects and alerts; IPS can block inline. Placement matters: a sensor that cannot see the traffic cannot protect it.
- VPNs create encrypted tunnels, commonly IPsec for site-to-site and TLS-based for remote access. Zero trust reduces reliance on network location by authenticating and authorizing each request.
- DNS security includes filtering, DNSSEC integrity, and monitoring for tunneling. DDoS controls absorb or scrub volumetric and application-layer floods.
Worked example
An internet-facing web application is being scanned and probed. The application sits behind a WAF in blocking mode, a load balancer, and a segmented DMZ. The database is in a private subnet reachable only from the application tier. Logs flow to a SIEM, and alerts trigger on repeated 403s, unusual POST volumes, and outbound connections from the database host. This combines prevention, detection, and containment rather than relying on one device.
Traps that cost marks
Do not use NAT as a security control. Do not place an IDS where it cannot see the traffic. Do not assume a VPN grants least privilege. Do not confuse a WAF with a network firewall, or DNSSEC with DNS filtering.