Network Security Fundamentals
Network Security Fundamentals
This domain tests how well you understand packet flow, addressing, and where security controls actually sit. Expect questions on the TCP/IP layer model, stateful inspection, segmentation, NAT, and the limits of encryption.
Core rules and concepts
- Defense in depth places independent controls at host, network, and application layers; no single control is trusted to stop everything.
- A stateful firewall tracks the five-tuple and connection state, so return traffic is permitted without an explicit inbound rule. A stateless ACL evaluates every packet in isolation and needs rules in both directions.
- VLANs create separate broadcast domains but are not, by themselves, security boundaries. Inter-VLAN traffic is routed, so enforcement requires ACLs or a firewall on the routed path.
- NAT conserves addresses; it is not an access control. Do not treat a private address range as a security zone.
- TLS protects data in transit between endpoints. It does not validate the endpoint, prevent malware on the host, or replace authentication.
- Apply least privilege to network access: restrict source, destination, port, and direction; use 802.1X for port-level admission control where deployed.
Worked example
A firewall rule permits 10.1.20.0/24 to 10.1.30.0/24 on any port. An analyst sees 10.1.20.15 connect to 10.1.30.20:445 (SMB) every few minutes. The rule is permitted, but the traffic is suspicious because SMB should not normally cross a VLAN boundary from a user segment to a server segment. The reasoning: permitted does not mean expected. Check whether 10.1.30.20 is a file server, whether the user has a business need, and whether SMB signing is enforced. Recommend replacing the broad rule with host-to-host rules on 445 and segmenting the server VLAN.
Traps that cost marks
- Saying a VLAN isolates traffic without noting the routed path.
- Treating NAT as a firewall.
- Forgetting return traffic when writing stateful rules.
- Assuming encryption means safe content.