Network Security
Network Security
This domain tests security design and control placement: segmentation, access control, encryption, and identity. Expect scenario questions about where to apply a control and what it actually inspects.
Core rules
- The CIA triad-confidentiality, integrity, availability-frames most decisions. Least privilege and defense in depth reduce blast radius; zero trust removes implicit trust based on network location.
- Standard ACLs filter by source only and should be placed near the destination. Extended ACLs filter source, destination, protocol, and port, and should be placed near the source to conserve bandwidth.
- Stateful firewalls track flows and allow return traffic; stateless ACLs require explicit return rules. IDS detects and alerts; IPS can block inline.
- IPsec uses IKE to negotiate SAs. AH provides integrity and authentication but not encryption; ESP provides confidentiality and optional integrity. TLS protects application sessions such as HTTPS.
- 802.1X authenticates supplicants before granting port access, typically with RADIUS and EAP.
Worked example You must permit HTTP from 10.1.1.0/24 to 10.2.2.10 and deny other traffic. An extended ACL entry is: permit tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 80. The wildcard 0.0.0.255 matches the /24; host matches one address; eq 80 matches HTTP. Place it inbound on the 10.1.1.0 interface so unwanted traffic is dropped early. Remember the implicit deny at the end.
Traps ACL order matters: a broad permit before a specific deny makes the deny unreachable. Wildcard masks are inverse subnet masks, not subnet masks. A stateful firewall rule does not need a separate return rule, but a stateless ACL does. Do not say AH encrypts payload; it does not.