I85PREP
⌘ K
NCJOSI study materials
NCJOSI study resources

NCJOSI: Network Security Fundamentals

NCJOSI · Work through your exam, one topic at a time.

All guide sections

Network Security Fundamentals

Network Security Fundamentals tests whether you can explain how traffic actually moves and where a control can be inserted to stop it. Expect questions on layering, segmentation, firewall behaviour, and secure protocol choices rather than product trivia.

Core rules

  • Controls map to layers: port security and 802.1X at L2, ACLs and routing policy at L3, stateful filtering at L3-L4, proxies and WAFs at L7.
  • A packet-filter ACL is stateless and needs an explicit rule for return traffic; a stateful firewall tracks the TCP handshake and permits replies automatically.
  • Firewall rules are evaluated top-down, first match wins, and normally end in an implicit deny. Moving a rule changes its meaning.
  • Segmentation (VLANs, subnets, security groups, microsegmentation) limits east-west movement; a DMZ separates internet-facing hosts from internal assets.
  • NAT conserves addresses; it is not a security control.
  • Prefer WPA3-SAE over WPA2-PSK, disable WPS, and use 802.1X with EAP-TLS for enterprise wireless.
  • Management planes (SSH, SNMPv3, HTTPS) belong on a restricted or out-of-band network.

Worked example

An engineer appends permit tcp any host 10.0.5.10 eq 443 to the bottom of an ACL that already ends in deny ip any any, then reports that HTTPS to the web server fails. Because evaluation is first-match-wins, the deny-any is reached before the new permit is ever read. The fix is to place the permit above the deny rule, then re-test from the client VLAN. The exam point: rule position is part of the policy, so the change goes through change control and is verified against the original requirement, not just against the symptom.

Traps that cost marks

  • Assuming a stateful firewall needs a mirror rule for return traffic.
  • Treating NAT or a VLAN as an access-control boundary on its own.
  • Forgetting that an IDS sensor placed inside an encrypted TLS session sees nothing useful without decryption or endpoint telemetry.
  • Confusing L2 broadcast domains with L3 subnets when reasoning about lateral movement.
  • Overlooking that implicit deny also blocks your own management access if you filter it in the wrong direction.