Secure Enterprise Infrastructure

Device placement and security zones. Placement defines capability. A firewall at the perimeter filters inbound traffic from untrusted networks; the same firewall inside a data center enforces zone boundaries. Common zones: perimeter/external, DMZ for internet-facing services, internal for business systems, management for admin access, OT for industrial/operational tech, and guest for visitor traffic. Each zone gets its own policy; a box in the wrong zone sees too much or too little traffic.

Attack surface. The aggregate of everything externally reachable. Reduce it by closing unused ports, disabling unused services, pruning exposed APIs, and removing default credentials. The smaller the surface, the less there is to patch, monitor, and defend.

Connectivity. Site-to-site VPN (usually IPSec) connects branch to HQ. MPLS is a carrier-managed private WAN. Direct-connect services (AWS Direct Connect, Azure ExpressRoute) give private low-latency links to cloud providers.

Failure modes. Fail-open means a device failure allows all traffic — availability first. Fail-closed means a device failure blocks all traffic — security first. Most enterprise firewalls fail closed. Some inline IPS deployments choose fail-open to keep the business running during an appliance fault.

Device attributes. Active devices modify or block traffic (firewall, IPS); passive devices only observe (IDS, network tap). Inline devices sit in the traffic path and can block; tap/monitor devices mirror traffic and can only alert. If a scenario says “must block” you need an inline active device; if it says “must observe without impact” you need a tap or SPAN.

Network appliances. A jump server (bastion host) is the single controlled path for admins to reach a sensitive zone — no direct admin connections from user workstations. Proxies come in two flavors: a forward proxy sits between clients and the internet (filtering, logging, caching); a reverse proxy sits in front of servers (TLS termination, load balancing, caching). IDS vs IPS: both detect; only IPS blocks. Load balancers distribute traffic across backend pools — L4 (TCP) or L7 (HTTP) — and often handle SSL offload and health checks. Sensors are taps, SPAN ports, and host agents feeding a SIEM.

Port security: 802.1X and EAP. 802.1X is port-based Network Access Control (NAC) — a device must authenticate before the switch grants network access. EAP (Extensible Authentication Protocol) is the framework used inside 802.1X. Common flavors: EAP-TLS (certificate-based, strong), PEAP (tunneled), EAP-TTLS. Wrong answer pattern on the exam: confusing 802.1X (port auth) with 802.11 (wireless).

Firewall types. Layer 4 (stateful packet) firewall — port/protocol based, tracks connection state. Layer 7 firewall / NGFW — application-aware, user-aware, can identify and block specific applications regardless of port; often integrates threat intel, IPS, and URL filtering. Web Application Firewall (WAF) — HTTP-only, blocks OWASP Top 10 patterns (SQLi, XSS, CSRF). Unified Threat Management (UTM) — all-in-one bundle (firewall + IDS + AV + URL + VPN) aimed at small/mid-size orgs. The exam tests matching the right tool to the scenario: HTTP app protection → WAF; broad enterprise L7 → NGFW; SMB one-box → UTM; port/protocol enforcement → L4.

Secure communication and access. VPN: site-to-site (branch-to-HQ, usually IPSec) and remote access (user-to-network, SSL VPN or IPSec). Remote access patterns include VPN, RDP gateway, and SSH bastion. TLS protects the session (HTTPS, SMTPS, modern VPNs); keys are session-scoped, authentication via certificates. IPSec protects the network layer; modes are transport (host-to-host; only payload encrypted) and tunnel (gateway-to-gateway; entire original packet encrypted). Components: AH (Authentication Header, integrity + origin auth, no confidentiality), ESP (Encapsulating Security Payload, confidentiality + integrity), and IKE (Internet Key Exchange) to negotiate keys.

SD-WAN and SASE. SD-WAN is a software-defined WAN overlay — vendor-managed policy routing across multiple underlying links (MPLS, broadband, LTE). SASE (Secure Access Service Edge) is the convergence of network and security as a cloud service: FWaaS, SWG (Secure Web Gateway), CASB (Cloud Access Security Broker), and ZTNA (Zero Trust Network Access) delivered from cloud edges close to users. SASE is a design pattern, not a single product.

Selection of effective controls. Map the threat/vulnerability (from Domain 2) to a control category (technical / administrative / physical) and a control type (preventive / detective / corrective / compensating). Consider residual risk, cost, operational burden, and whether the control sits where the attack actually crosses.

A regional water utility runs a SCADA network controlling pumps and valves. Leadership wants “intrusion prevention” after a compliance finding. The vendor suggests dropping an IPS inline in front of the SCADA network. The OT engineers panic — if the IPS drops a legitimate Modbus command, a pump stops and customers lose water pressure. The Network Admin proposes an IDS instead; the Security Architect builds a compromise.