Network Security

What this unit covers

The topics below follow the published Networking course framework for Unit 5. Networking publishes no per-unit weighting, so there is no percentage to chase here.

Lessons in this unit

• Segmentation, Firewalls, and Zero Trust18 min · 3 objectivesExplain network access policy and containment · Apply the idea to evidence from a realistic technology scenario · Justify a decision using security, reliability, cost, and user impact
• Secure Management and Remote Access18 min · 3 objectivesExplain protecting administrative planes and remote connections · Apply the idea to evidence from a realistic technology scenario · Justify a decision using security, reliability, cost, and user impact
• Detection and Network Incident Response18 min · 3 objectivesExplain network security evidence and response · Apply the idea to evidence from a realistic technology scenario · Justify a decision using security, reliability, cost, and user impact

Every term in Unit 5

All 40 terms we publish for Network Security, with definitions. Reading them through is the fastest way to find the ones you cannot define — then drill those in cram mode until you can produce them without the prompt.

Defense in depth

Independent layers of control, so one failure is not a breach. A firewall, segmentation, authentication and endpoint protection are all doing different jobs.

Network segmentation

Dividing the network so a compromise in one part cannot reach another. The structural control that most limits how far an intrusion spreads.

VLAN as a security boundary

Separating traffic logically, so devices that have no business talking cannot. Guest wireless, cameras and payment systems belong on their own segments.

Screened subnet (DMZ)

A segment for public-facing servers, reachable from outside but restricted from reaching the internal network. Compromising the web server should not reach the file server.

Firewall

Enforces rules about what traffic may pass between networks. The ruleset is the security; the appliance is where it runs.

Stateful inspection

Tracking connections so replies to permitted outbound traffic are allowed automatically, without a matching inbound rule.

Access control list

An ordered set of permit and deny rules matched top to bottom, ending in an implicit deny. Rule order changes the outcome.

Implicit deny

Anything not explicitly permitted is blocked. The correct default, and the reason a new service does not work until someone adds a rule.

Least privilege on a network

Each host and user reaches only what its role requires. Flat networks where everything can reach everything are the condition ransomware spreads best in.

Network access control (NAC)

Checking a device's identity and health before granting network access, and quarantining what fails. 802.1X is the usual mechanism.

802.1X

Port-based authentication: a device authenticates to a server before the switch port or wireless network carries its traffic.

Port security as one layer of defense

Limiting which MAC addresses a switch port accepts. Weak alone, because MAC addresses are spoofable, and useful as one layer.

MAC filtering limits

Allowlisting hardware addresses stops casual connection and nothing else — addresses are visible in traffic and trivially changed.

VPN

An encrypted tunnel carrying private traffic across an untrusted network. Confidentiality and integrity over infrastructure you do not control.

Site-to-site vs remote-access VPN

Site-to-site joins two networks permanently through gateway devices. Remote-access connects one user's device to the network on demand.

IPsec

A protocol suite securing IP traffic itself, with AH for integrity and ESP for encryption. The common basis of site-to-site VPNs.

Split tunneling

Sending only corporate traffic through the VPN and the rest direct to the internet. Saves bandwidth and removes the organization's visibility and filtering from the rest.

Secure protocol substitutions

SSH for Telnet, HTTPS for HTTP, SFTP or FTPS for FTP, SNMPv3 for earlier versions, LDAPS for LDAP. Each replaces a plain-text protocol with an encrypted equivalent.

Why plain-text protocols are unacceptable

Anyone positioned on the path reads credentials and content directly. Telnet and FTP transmit passwords in the clear, which is enough on its own.

Encryption in transit vs at rest

TLS and VPNs protect data moving; disk and database encryption protect it stored. Both are needed, and neither covers the other.

Certificate validation

Checking a certificate is signed by a trusted authority, matches the hostname, and is unexpired and unrevoked. Clicking through the warning discards all of it.

Denial-of-service

Exhausting capacity so legitimate users cannot get service. Attacks availability, and does not require access to anything.

DDoS mitigation

Upstream filtering, rate limiting, anycast distribution and scrubbing services. Nothing at the victim's own link helps once the link itself is saturated.

On-path attack

An attacker between two parties reading or altering traffic. Authenticated encryption defeats it; unauthenticated encryption does not.

ARP poisoning

Forged ARP replies that redirect local traffic through the attacker. Dynamic ARP inspection and static entries on critical hosts limit it.

DNS poisoning and DNSSEC

Corrupting resolution so a correct name reaches the wrong address. DNSSEC signs records so tampering is detectable.

Rogue access point and evil twin

An unauthorized access point, sometimes broadcasting a legitimate SSID. Wireless scanning finds them; a network without wireless monitoring never will.

Wireless security standards

WEP is broken and must not be used, WPA2 remains widespread, WPA3 resists offline password attacks and adds forward secrecy.

Guest network isolation

Guest wireless on its own segment with no route to internal resources, and client isolation so guests cannot see each other.

IDS vs IPS

Detection alerts on suspicious traffic; prevention sits inline and blocks it. One cannot stop an attack, the other can block legitimate traffic.

SIEM

Central collection and correlation of logs from across the network, turning isolated events into a detectable pattern.

Log correlation across devices

A firewall denial, a failed login and an outbound transfer mean little separately and describe an intrusion together. Correlation needs synchronized clocks, which is why NTP is a security service.

Honeypot

A decoy system with no legitimate purpose, so any interaction with it is by definition suspicious.

Vulnerability scanning

Automated identification of known weaknesses and missing patches across the network. Finds exposure without exploiting it.

Penetration testing

Authorized simulated attack that attempts real exploitation to show what an attacker could reach. Requires written scope and permission.

Incident evidence

Logs, packet captures, device configurations and disk images collected during an incident. Their usefulness depends on being collected before systems are rebuilt.

Order of volatility

Collect the most perishable evidence first — memory and active connections before disk, disk before backups. Rebooting a compromised host destroys the most useful evidence there is.

Chain of custody

A documented record of who handled evidence, when, and why. Broken custody can make sound evidence unusable.

Containment before eradication

Isolate the affected systems before cleaning them, or the intrusion spreads while you work. Pulling the network cable is a legitimate first move.

Incident response phases

Preparation, identification, containment, eradication, recovery, lessons learned. The last phase is what prevents a repeat, and is the one most often skipped.

What examiners penalize here

• For a scenario about **network access policy and containment**, identify the decisive evidence before naming a response. A defensible conclusion here is: Create a distinct guest segment with default-deny access to internal resources.
• For a scenario about **protecting administrative planes and remote connections**, identify the decisive evidence before naming a response. A defensible conclusion here is: Remove Telnet and shared credentials, restrict reachability, and log accountable encrypted administration.
• For a scenario about **network security evidence and response**, identify the decisive evidence before naming a response. A defensible conclusion here is: The correlated timeline supports rapid containment while a broader scope investigation continues.

Practice Networking

Our practice bank is drawn from across the whole course rather than filtered to one unit, which is closer to how the exam asks anyway — it will not tell you which unit a question is testing.

Questions about this unit

All 5 units of AP Networking

1. Unit 1 · Network Foundations
2. Unit 2 · Network Infrastructure
3. Unit 3 · Network Services
4. Unit 4 · Network Operations
5. Unit 5 · Network Security