Network Security
Network Security covers enforcement on the traffic path: security policy, application identification, segmentation, decryption, and threat prevention. The exam tests whether you can reason about policy order, zone trust, and which control actually sees the traffic, rather than reciting product menus.
Core rules
- Security policy is evaluated top-down and stops at the first match; the implicit rules at the bottom are intrazone allow and interzone deny. A rule placed below a broader permit never fires.
- Identify applications, not just ports. Modern apps share 443, so App-ID and URL category decide whether a flow is SaaS file sharing or business software.
- Decryption is a prerequisite for inspection. SSL forward proxy lets the firewall see server certificates and block expired or untrusted ones; exceptions should be narrow and justified.
- Attach threat, antivirus, and file-blocking profiles to the rules that permit the traffic. A permit rule without a profile is a hole.
- Segmentation limits lateral movement. Zone design and microsegmentation should reflect data sensitivity, not org charts.
Worked example
Sales needs a SaaS CRM but must not upload customer exports to personal storage. Build a rule from the user group to the CRM app with a URL category allow, then file blocking and DLP for the export pattern. Add a lower rule permitting general web with a block for personal-storage categories. Reasoning: matching the specific app first preserves functionality while the broader rule handles everything else, and the profile enforces the data rule at the point of egress.
Traps
Forgetting the implicit intrazone allow. Putting a deny below a broader permit. Assuming NAT changes policy evaluation order. Leaving decryption exceptions so wide that inspection is bypassed. Testing with the wrong source user or zone.