Network security architecture, design, and risk assessment
The exam tests whether you can run a defensible, risk-driven network security design process - documented and verified - rather than jumping straight to products.
The design process (27033-2)
- Define scope, business requirements and constraints.
- Identify assets, data flows and trust relationships.
- Assess risk: threats, vulnerabilities, likelihood, impact.
- Derive the security architecture: domains, boundaries, gateways.
- Produce the detailed design, implement, verify and document.
- Maintain it through change management and periodic review.
Architecture concepts
Design starts from security domains - groupings of assets with common trust and policy - separated by security gateways at every boundary. 27033-3 supplies reference scenarios (internet access, remote access, WAN, wireless, DMZ, e-commerce) with typical threats and control options, so you never design from a blank page. Add defence in depth, choke points, redundancy for availability, and explicit fail-open or fail-closed choices. Document the design so it can be audited and changed safely.
Worked example
A supplier needs a B2B link into an order system. Risk assessment: untrusted partner network, possible data exfiltration, availability dependency. Design: a dedicated DMZ segment instead of direct access to the internal LAN, a redundant firewall pair as the security gateway (27033-4), an IPsec VPN with mutual authentication for the transit link (27033-5), least-privilege rules allowing only the order API, and logging to the SIEM. Reasoning: each element maps to an identified threat, and the residual risk of partner-side compromise is accepted with contractual and monitoring controls.
Traps
Choosing products before assessing risk; drawing zones without naming the gateway that enforces each boundary; assuming VLANs alone constitute segregation; omitting verification and documentation so nobody can prove the design works.