Network Security
Domain 3 tests how you reduce network attack surface and enforce traffic policy. Expect zoning, segmentation, DMZs, firewall rule design, stateful inspection, VPNs, IDS/IPS placement, egress filtering, and zero-trust principles.
Core rules
- Segmentation limits lateral movement. Place internet-facing services in a DMZ and keep sensitive data in a separate internal zone.
- Firewall rules should be least-privilege, specific in source, destination, port, and protocol, and ordered so broad permits do not shadow denies. Most firewalls end with an implicit deny; make critical denies explicit for clarity.
- Stateful firewalls track connections; stateless ACLs evaluate each packet independently. Do not assume NAT provides security.
- Egress filtering matters: outbound controls can disrupt command-and-control and data exfiltration.
- IDS detects and alerts; IPS can block inline. Placement must match what you need to see, such as north-south traffic at the perimeter or east-west traffic between segments.
Worked example
A public web server in a DMZ must reach an internal database. A poor rule permits the DMZ subnet to the database subnet on all ports. A better design allows only the web server IP to the database IP on the database port, denies the database outbound internet access, logs denied traffic, and requires a managed jump path for administration. The reasoning is explicit flow control: permit the required service, remove unnecessary paths, and retain evidence of blocked attempts.
Traps
Avoid any-any rules, broad management exposure, and treating VLANs alone as complete isolation. Do not place an IPS where encrypted traffic bypasses it without a deliberate inspection design.