Communication and Network Security
The Communication and Network Security domain tests secure network design, protocol behavior, segmentation, and boundary defenses. Questions often ask where to place a control, which protocol provides which guarantee, and how to limit lateral movement.
Core rules and concepts
- Map controls to layers: physical and data link (802.1X, MAC filtering), network (IPsec, routing, ACLs), transport (TLS, TCP), application (WAF, DNSSEC, application auth).
- Stateful firewalls track sessions; stateless packet filters evaluate each packet against rules. A WAF inspects HTTP content; a network firewall does not.
- Segmentation uses VLANs, subnets, security groups, and microsegmentation. A DMZ isolates internet-facing services from internal data. VLANs alone are not a strong boundary without filtering.
- IPsec tunnel mode protects gateway-to-gateway traffic; transport mode protects host-to-host. TLS protects application sessions and authenticates the server, but does not by itself authorize users.
- WPA3 improves wireless authentication and encryption over WPA2; rogue APs and evil twins target client behavior.
Worked example
A public web application must reach an internal database. Place the web server in a DMZ. Allow internet to WAF on 443 only; allow WAF to web server on 443; allow web server to application server on 8443; allow application server to database on 1433. Deny all other traffic and log denies. Do not allow the web server direct database access, because that expands the blast radius if the web tier is compromised. The rule set enforces least privilege between tiers.
Traps
Believing TLS encrypts data at rest; confusing IPsec modes; treating a VLAN as a firewall; and allowing “any” from the DMZ to the internal network, which defeats segmentation.