Network Security and Architecture
Network Security and Architecture
This domain tests segmentation, control placement, and whether you can choose the right enforcement point for a specific traffic flow rather than stacking appliances.
Core rules
- Map traffic first: north-south (client to data center) versus east-west (server to server). Microsegmentation targets east-west.
- Segmentation tools: VLANs, subnets, security groups, firewalls, and zero-trust policy keyed to identity and device posture instead of IP address alone.
- A DMZ hosts internet-facing services. It is a lower-trust zone, not an implicit trust boundary.
- Firewall types: stateless packet filter (5-tuple), stateful inspection (connection table), NGFW (application awareness, IPS, TLS inspection), WAF (HTTP/S, OWASP Top 10).
- IDS is passive (SPAN or TAP); IPS is inline and can block, but adds latency and a failure point.
- VPN: IPsec for site-to-site (IKEv2, ESP), TLS VPN for remote access. Management planes need authenticated, encrypted access.
Worked example
A public web application must block SQL injection, and the SOC wants to detect lateral movement between the app and database tiers. Place a WAF inline in front of the load balancer to block layer-7 attacks. Place a stateful firewall between the app and database subnets with default-deny and only port 5432 open. Put an IDS sensor on a SPAN port in the database VLAN to catch scanning, because blocking is not required there and an inline failure would threaten availability.
Traps that cost marks
- Inlining an IPS where a false positive would take down production with no bypass path.
- Treating "behind the firewall" as trusted; a flat internal network is a top finding.
- Forgetting that TLS inspection breaks certificate pinning and needs its own governance.
- Confusing a WAF with a network firewall: a WAF cannot see non-HTTP traffic.