CompTIA Security+ Preparation · lesson 24 of 45 · 25 min
Network Security Architecture Components
NAC (Network Access Control) — controls which devices can connect to the network. Checks device health (patch level, AV status, OS version) before granting access. Uses 802.1X for port-based authentication. Non-compliant devices are quarantined.
Proxy server — intermediary between clients and the internet. Forward proxy: clients connect through it (content filtering, caching, anonymity). Reverse proxy: sits in front of servers (load balancing, SSL termination, WAF).
Load balancer — distributes traffic across multiple servers. Provides availability and scalability. Can perform SSL termination, health checks, and session persistence.
WAF (Web Application Firewall) — filters HTTP/HTTPS traffic to protect web applications. Blocks SQLi, XSS, CSRF, and other OWASP Top 10 attacks. Operates at Layer 7. Can be inline (blocking) or monitoring mode.
SIEM (Security Information and Event Management) — collects, aggregates, and correlates log data from across the environment. Provides real-time alerting, dashboards, and forensic investigation. Examples: Splunk, Microsoft Sentinel, IBM QRadar.
SOAR (Security Orchestration, Automation, and Response) — automates repetitive security tasks and incident response workflows. Uses playbooks to respond to alerts automatically. Reduces mean time to respond (MTTR).
Key Terms
Key Terms
Knowledge Check — 10 Questions
Security+ — Secure Network Design
NAC quarantines devices that:
- Have too much traffic
- Fail health checks (missing patches, no AV)
- Are too old
- Have too many users
- Answer: Fail health checks (missing patches, no AV)
NAC enforces endpoint compliance — devices that fail health checks (unpatched, no AV, wrong OS) are quarantined until remediated.
A WAF operates at which OSI layer?
- Layer 2
- Layer 3
- Layer 4
- Layer 7
Answer: Layer 7
WAFs operate at the application layer (Layer 7) — they inspect HTTP/HTTPS content to detect and block application attacks.
SOAR reduces which security metric?
- CVSS score
- Mean Time to Respond (MTTR)
- Number of vulnerabilities
- Log volume
Answer: Mean Time to Respond (MTTR)
SOAR automates repetitive response tasks — dramatically reducing the time from alert to containment.
A reverse proxy differs from a forward proxy in that:
- A reverse proxy serves clients; a forward proxy serves servers
- A reverse proxy sits in front of servers; a forward proxy sits in front of clients
- They are identical
- A reverse proxy is less secure
Answer: A reverse proxy sits in front of servers; a forward proxy sits in front of clients Forward proxy: clients → proxy → internet. Reverse proxy: internet → proxy → servers. Reverse proxies protect and load-balance servers. SIEM provides:
- Automatic vulnerability patching
- Log collection, correlation, and real-time alerting
- Network access control
- Web application filtering
- Answer: Log collection, correlation, and real-time alerting
SIEM aggregates logs from all sources, correlates events to detect threats, and alerts security analysts in real time. 802.1X is used by NAC for:
- Wireless encryption
- Port-based network access authentication
- VPN tunneling
- DNS resolution
- Answer: Port-based network access authentication
802.1X provides port-based authentication — devices must authenticate before the switch port is opened. SSL termination at a load balancer means:
- SSL is disabled
- The load balancer decrypts SSL traffic, then forwards plaintext to backend servers
- SSL is re-encrypted twice
- The backend servers handle SSL
Answer: The load balancer decrypts SSL traffic, then forwards plaintext to backend servers SSL termination offloads decryption from backend servers — the load balancer handles the computationally expensive SSL handshake. SOAR playbooks are used to:
- Document security policies
- Automate repetitive incident response steps
- Train security analysts
- Scan for vulnerabilities
- Answer: Automate repetitive incident response steps
Playbooks define automated workflows — e.g., when a phishing alert fires, automatically quarantine the endpoint and reset the user’s password.
Which tool would detect a SQL injection attempt against a web application?
- NAC
- SIEM
- WAF
- Load balancer
Answer: WAF
WAFs inspect HTTP request content — they detect and block SQL injection, XSS, and other application-layer attacks.
SIEM stands for Security Information and Event _____.
Answer: Management
SIEM = Security Information and Event Management — the central platform for log aggregation, correlation, and alerting.
Previous lesson: Cloud service models: IaaS, PaaS, SaaS — security responsibilities at each layer
Back to CompTIA Security+ Preparation
Next lesson: Zero trust architecture: identity, microsegmentation, least privilege