Network and Communications Security
Network and Communications Security covers how data moves safely across segments, protocols, and untrusted links. The exam favors protocol purpose and control placement over port memorization.
Core rules
- Segment with VLANs, subnets, and firewalls; VLANs separate broadcast domains but are not a strong boundary without routing and filtering.
- A firewall enforces policy; an IDS detects and alerts; an IPS can block inline. Place controls where traffic actually crosses, and default-deny.
- TLS protects application traffic end to end; IPsec protects IP packets in tunnel or transport mode. VPNs extend a trusted path but do not make endpoints trustworthy.
- Wireless: WPA2/WPA3 with strong enterprise authentication; avoid WEP and WPS. DNSSEC signs DNS data for integrity but does not encrypt queries.
- Log and monitor egress, remote access, and administrative planes. Zero-trust designs authenticate and authorize each request rather than trusting network location.
Worked example
A web server must accept HTTPS from the internet and database traffic only from an application subnet. The rule set should deny by default, permit TCP 443 to the web server from any, permit the database port only from the app subnet, and log denied traffic. Opening the database port to internal is too broad because a compromised user workstation would then reach it. The reasoning is based on least reachability, not convenience.
Traps
An IDS is not an IPS. TLS does not replace authentication of users. DNSSEC does not hide queries. A VPN does not patch a vulnerable laptop. Internal is not a trust zone by itself.