Network Security Fundamentals
What this domain tests
Network Security Fundamentals tests whether you can place controls at the right layer and explain what each one actually inspects. Questions commonly cover segmentation, firewalls, IDS versus IPS, VPN and TLS, DNS security, and secure architecture patterns such as DMZs.
Core rules
- Stateful firewalls track connection state and allow return traffic; stateless ACLs evaluate each packet independently and must allow both directions explicitly.
- IDS detects and alerts; IPS sits inline and can block. A sensor that only receives a mirror of traffic cannot stop an attack.
- Segmentation and microsegmentation limit lateral movement. A DMZ holds internet-facing services away from internal systems.
- TLS protects data in transit and provides confidentiality and integrity, but not endpoint security. DNSSEC signs DNS records for authenticity and integrity; it does not encrypt queries.
- ZTNA grants application-level access after identity and device checks rather than placing users flat on the network.
Worked example
A public web application is placed in a DMZ. The web tier may reach the application tier only on TCP 8443, and the application tier may reach the database only on TCP 5432. The database has no internet route. A WAF filters HTTP, and egress filtering blocks outbound traffic to unknown hosts. If the web server is compromised, the attacker still faces identity-aware, least-privilege paths to the data.
Traps that cost marks
- Confusing IDS with IPS.
- Forgetting that stateless ACLs need return-path rules.
- Believing TLS inspection is free: it breaks end-to-end trust and raises privacy issues.
- Assuming a VLAN alone is a security boundary when routing between VLANs is unrestricted.