SecurityX level · Domain 3.0 Security Engineering · 31% of the mapped exam

3.3 Given a scenario, troubleshoot complex network infrastructure security issues.

26 topics · 4 quiz questions

Complex network security problems usually trace back to misconfiguration, broken trust (certificates, DNS) or capacity. Diagnose from evidence, not guesses.

Network misconfigurations

Configuration drift: Devices diverging from approved configs; detect with config management and diffing.
Routing errors: Wrong or missing routes causing outages or bypassing inspection.
Switching errors: VLAN, trunk or spanning-tree mistakes.
Insecure routing: Unauthenticated routing protocols open to route injection; enable routing authentication and RPKI for BGP.
VPN/tunnel errors: Mismatched IKE/IPsec parameters, expired certificates or overlapping subnets.

IPS/IDS issues

Rule misconfigurations: Rules too broad, too narrow or in the wrong order.
Lack of rules: Missing signatures for relevant threats.
False positives/false negatives: Noise that hides real alerts, or real attacks missed.
Placement: Sensors that cannot see the relevant (or decrypted) traffic.

Observability and DNS

Observability: Having the logs, metrics and flows needed to diagnose problems.
Domain Name System (DNS) security: Protecting name resolution from tampering and abuse.
Domain Name System Security Extensions (DNSSEC): Signs DNS records so resolvers can verify authenticity; failures occur with expired signatures or broken key rollover.
DNS poisoning: Injecting false records into resolver caches.
Sinkholing: Redirecting known-malicious domains to a controlled address to block and identify infected hosts.
Zone transfers: AXFR should be restricted to authorised secondaries; open transfers leak the whole zone.

Email security

Domain Keys Identified Mail (DKIM): Signature failures from body changes by forwarders or wrong selectors.
Sender Policy Framework (SPF): Missing senders or too many DNS lookups (10-lookup limit) cause failures.
Domain-based Message Authentication Reporting & Conformance (DMARC): Alignment failures between From domain and SPF/DKIM domains; use reports to fix before enforcing.
Secure/Multipurpose Internet Mail Extension (S/MIME): Certificate-based email signing and encryption; issues with expired or untrusted certs.

Crypto and availability

Transport Layer Security (TLS) errors: Handshake failures from protocol mismatch, untrusted chains or name mismatch.
Cipher mismatch: Client and server share no allowed cipher suite.
PKI issues: Expired, revoked or incomplete certificate chains; unreachable CRL/OCSP.
Issues with cryptographic implementations: Bugs or misuse such as reused nonces or weak randomness.
DoS/distributed denial of service (DDoS): Floods exhausting bandwidth, connections or application resources.
Resource exhaustion: CPU, memory, connection tables or state tables filling up.
Network access control list (ACL) issues: Wrong order, missing return rules or overly broad permits.

Check your understanding

Loading quiz…

< 3.2 previous 3.4 next >

Original CoreQ Academy material, mapped to objective 3.3 of the publicly available CompTIA SecurityX CAS-005 exam objectives (Exam objectives V5, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.