CoreQ Academy3.2 Given a scenario, apply security principles to secure enterprise infrastructure.
This objective is about placing and configuring network security devices well: putting the IPS in the right spot, choosing fail-open or fail-closed, deciding between VPN types and using the right firewall layer.
Infrastructure considerations
- Device placement
- Where a control sits determines what it sees and protects: firewall at boundaries, IDS sensors where traffic converges, WAF in front of web apps.
- Security zones
- Areas with similar trust levels (internet, screened subnet, internal, restricted) with controlled traffic between them.
- Attack surface
- All reachable entry points; minimise what each zone exposes.
- Connectivity
- How zones and sites connect, and how those links are protected.
- Failure modes
- What a device does when it fails.
- Fail-open
- Traffic passes if the device fails. Keeps availability, loses protection.
- Fail-closed
- Traffic is blocked if the device fails. Keeps protection, loses availability.
- Device attribute: active vs. passive
- Active devices can block or change traffic; passive devices only observe and alert.
- Device attribute: inline vs. tap/monitor
- Inline devices sit in the traffic path and can block (IPS); tap/monitor devices receive a copy of traffic (IDS via SPAN or network tap).
Network appliances
- Jump server
- A hardened host used as the only path to administer sensitive systems; centralises logging and control.
- Proxy server
- Makes requests on behalf of clients; can filter, cache and log web traffic. A reverse proxy sits in front of servers.
- Intrusion prevention system (IPS)/intrusion detection system (IDS)
- IDS detects and alerts; IPS sits inline and can block. Both use signatures and anomaly detection.
- Load balancer
- Distributes traffic across servers for availability and performance; can also terminate TLS.
- Sensors
- Collect network or host data for monitoring tools.
Port security
- Port security
- Controls what can connect to a switch port, for example limiting MAC addresses.
- 802.1X
- Port-based network access control: a device must authenticate (via a RADIUS server) before the switch or access point grants network access.
- Extensible Authentication Protocol (EAP)
- The framework 802.1X uses to carry authentication methods such as EAP-TLS (certificates) or PEAP.
Firewall types
- Web application firewall (WAF)
- Inspects HTTP traffic to web apps and blocks attacks like SQLi and XSS.
- Unified threat management (UTM)
- One appliance combining firewall, IPS, antivirus, content filtering and VPN. Simple but a single point of failure.
- Next-generation firewall (NGFW)
- Application-aware firewall with user identity, IPS and deep inspection.
- Layer 4/Layer 7
- Layer 4 firewalls filter on IPs and ports; Layer 7 firewalls understand applications and content.
Secure communication/access
- Virtual private network (VPN)
- Encrypted tunnel across an untrusted network.
- Remote access
- Letting users connect from outside, ideally through VPN or Zero Trust access with MFA.
- Tunneling
- Encapsulating one protocol inside another.
- Transport Layer Security (TLS)
- Encrypts application traffic (HTTPS); also used for TLS-based VPNs.
- Internet protocol security (IPSec)
- Encrypts at the network layer. AH provides integrity; ESP provides confidentiality. Common for site-to-site VPNs.
- Software-defined wide area network (SD-WAN)
- Software-managed WAN that routes traffic across multiple links (broadband, LTE, MPLS) efficiently.
- Secure access service edge (SASE)
- Cloud-delivered combination of networking (SD-WAN) and security (secure web gateway, CASB, Zero Trust access, firewall).
Selection of effective controls
- Selection of effective controls
- Choose controls based on the risk, the zone, the asset value and cost, and layer them so one failure does not expose everything.
Hands-on practice
Check your understanding
Knowledge quiz · pass mark 80%
- A firewall guarding the cardholder data environment fails. Protecting the data matters more than uptime. It should fail:
- Which protects a web app from SQL injection at the HTTP layer?
- Which requires devices to authenticate before a switch port grants network access?
- Cloud-delivered networking plus security services for remote users describes:
- An IDS connected to a network tap can directly block malicious traffic.
- Which device must be inline to block attacks in real time?
Original CoreQ Academy material, mapped to objective 3.2 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.