Networks, Segmentation, and Firewalls

You’ll be able to

Explain how segmentation limits blast radius
Interpret firewall rules as allow or deny decisions
Use log evidence to identify suspicious network activity

Segmentation limits movement

A flat network lets one compromised device reach too many other systems. Segmentation divides the network into zones, such as guest Wi-Fi, student devices, staff systems, and servers. Firewalls and access rules control which traffic can move between zones.

Worked example

A guest laptop on public Wi-Fi sends repeated connection attempts to an internal gradebook server on an administrative subnet.

1.The source zone is guest Wi-Fi and the destination is a sensitive internal service.
2.The behavior is suspicious because guest devices should not need direct gradebook access.
3.A firewall rule should deny guest-to-admin traffic by default.
4.Logs should record the blocked attempts for review and possible incident response.

Answer: The correct control is segmentation plus a default-deny firewall rule between guest and administrative networks.

Risk priority

Risk priority = likelihood x impact

The exact scale can vary, but AP scenarios usually reward the reasoning: common plus severe gets handled before rare plus minor.

Checkpoint

Why does network segmentation reduce risk?

Checkpoint

A firewall rule set ends with a rule permitting all remaining traffic. Why does this undermine the design?

Answer the 2 checkpoints as you read.