Network Security
Network security covers how Nokia service provider architectures protect infrastructure, subscribers, and services. The exam tests defense in depth across access, core, IP, and data center domains, including DDoS detection and mitigation, control-plane protection, segmentation, and identity-based access.
Security architecture principles
Security is layered: harden the control plane, filter at the edge, segment services, encrypt where required, and monitor flows continuously. Nokia Deepfield provides network-wide flow analytics and DDoS detection; NetGuard and 7750 SR functions can enforce filtering and scrubbing. BGP FlowSpec and remote-triggered blackhole routing are common mitigation tools, but each has trade-offs. Zero-trust design does not assume the internal network is safe; authentication and authorization are enforced per service and per operator role.
Rules to apply
- Control-plane protection comes first: rate-limit signaling, protect routing sessions, and restrict management access.
- DDoS mitigation needs detection, diversion, scrubbing, and clean traffic reinjection.
- RTBH discards traffic to a target; it protects the network but can also remove legitimate service.
- FlowSpec can filter specific flows, but it depends on correct match rules and router support.
- Encryption protects confidentiality and integrity; it does not replace segmentation or authorization.
Worked example
A DNS amplification attack saturates a transit link toward a subscriber prefix. Deepfield detects the abnormal flow profile. The operator diverts traffic for the target to a scrubbing center using FlowSpec or BGP diversion, filters the attack, and reinjects clean traffic. The reasoning: detection alone does not protect capacity; diversion and scrubbing must be pre-provisioned and tested. RTBH could be a last resort, but it would also blackhole legitimate subscriber traffic.
Traps that cost marks
Treating RTBH as harmless; assuming encryption replaces segmentation; deploying FlowSpec without validating match rules; and monitoring only at the edge while attacks saturate transit.