Network Security Fundamentals
What this domain tests
Network Security Fundamentals tests whether you can translate a business flow into enforceable network controls. Expect questions on the CIA triad, defense in depth, least privilege, trust boundaries, DMZ design, VLAN segmentation, ACLs, stateful firewalls, and egress filtering. The exam favors control placement and traffic-flow reasoning over product names.
Core rules
- A firewall rule is only as strong as its scope: define source, destination, service, direction, and action; default deny; log denies and sensitive allows.
- Segmentation reduces blast radius, but a VLAN is not a security boundary by itself; enforce with ACLs, security groups, or firewall policy between zones.
- Place public-facing services in a DMZ; keep databases and management planes in private zones with no direct internet path.
- Apply least privilege to both users and workloads; inspect ingress and egress; monitor flows for anomalies.
Worked example
A web app must be reachable on 443 from the internet and query a database on 3306. Permit internet to web tier on 443 only; permit web tier to database on 3306 from the web tier's address or security group only; deny all other inter-zone traffic; allow database updates through a controlled management path; log both allow and deny. If the web tier is compromised, the database is not directly reachable from the internet, and the 3306 rule limits lateral movement.
Traps
Do not confuse a vulnerability with a threat or risk; risk combines likelihood and impact in context. Do not assume NAT is a security control. Do not permit any-to-any for troubleshooting and leave it. Do not ignore egress: outbound controls limit command-and-control and data exfiltration.