Network Security and Perimeter Defense
Network Security and Perimeter Defense
This domain tests perimeter architecture, segmentation, firewall rule logic, IDS/IPS placement, remote access, and denial-of-service resilience. You should be able to choose controls for north-south and east-west traffic and explain why a given rule set fails.
Core rules
- Firewalls should enforce default deny with explicit permits, least privilege, and documented business justification. Rule order matters because most firewalls stop at the first match.
- Stateful firewalls track connections; stateless ACLs evaluate each packet independently. NGFWs add application identification, user awareness, and TLS inspection.
- A DMZ separates internet-facing services from internal networks. Microsegmentation restricts east-west traffic between workloads, where lateral movement occurs.
- IDS detects and alerts; IPS can block inline. Placement matters: a tap sees traffic but cannot stop it; an inline sensor can drop but becomes a failure point.
- 802.1X and NAC authenticate devices before network access. VPNs encrypt remote traffic; ZTNA applies identity and device posture per application rather than granting broad network access.
- DDoS controls include scrubbing, rate limiting, anycast distribution, and upstream provider mitigation.
Worked example
An ACL contains: permit tcp any host 10.0.0.5 eq 443; deny tcp host 203.0.113.9 any; permit ip any any. The deny never blocks the malicious host because the first permit already allowed its HTTPS traffic and the final permit allows everything else. Fix: place the deny before broad permits, scope the permit to required sources, and rely on implicit deny rather than permit ip any any.
Traps
- Believing NAT is a security control; it is address translation.
- Treating VLANs as sufficient segmentation; VLAN hopping and flat Layer 2 domains remain risks.
- Assuming encrypted traffic cannot be inspected; TLS inspection exists but has privacy and breakage costs.