CompTIA Network+ Preparation · lesson 22 of 30 · 25 min
Defense in Depth
Defense in depth layers multiple security controls so that if one fails, others still protect the network. No single control is sufficient — combine physical, technical, and administrative controls at every layer.
Network hardening applies the principle of least privilege (grant only necessary access), need to know (restrict information to those who need it), and separation of duties (no single person controls an entire process).
ACLs and Firewall Rules
ACLs (Access Control Lists) on routers and switches filter traffic based on IP addresses, protocols, and ports. Applied at the network perimeter and between internal segments.
Firewall rule best practices: default deny (block everything, permit only what is needed), log denied traffic, review rules regularly, remove unused rules, use stateful inspection (tracks connection state — allows return traffic automatically).
Stateful vs Stateless: Stateful firewalls track TCP/UDP sessions — return traffic is automatically permitted. Stateless firewalls (ACLs) evaluate each packet independently — require explicit rules for return traffic.
DMZ (Demilitarized Zone) — a network segment between the internet and the internal network hosting public-facing servers (web, mail, DNS). Traffic from the internet reaches the DMZ but cannot directly access the internal network.
Port Security and 802.1X
Port security limits which MAC addresses can connect to a switch port. Prevents unauthorized devices from connecting and MAC flooding attacks.
Configuration: switchport mode access → switchport port-security → switchport port-security maximum 2 → switchport port-security mac-address sticky (learns and saves MACs) → switchport port-security violation shutdown.
802.1X (Port-Based NAC) — requires authentication before granting network access. The switch (authenticator) blocks all traffic except EAP until the supplicant (client) authenticates with the RADIUS server. After successful authentication, the port is opened.
EAP methods: EAP-TLS (certificate-based, most secure), PEAP (password-based, uses TLS tunnel), EAP-TTLS.
NAC — Network Access Control
NAC enforces security policy before granting network access. Beyond authentication (802.1X), NAC can check:
— Posture assessment: Is the device patched? Is antivirus running and up to date? Is the firewall enabled?
— Remediation: Non-compliant devices are placed in a quarantine VLAN with access only to remediation resources (patch server, AV update server).
— Guest access: Unauthenticated devices get internet-only access via a captive portal.
Cisco ISE (Identity Services Engine) is the primary Cisco NAC solution.
VPNs and Encryption for Hardening
VPNs encrypt traffic over untrusted networks. For network hardening:
— Use VPNs for all remote management of network devices (no Telnet, no HTTP management).
— Use SSH (not Telnet) for CLI access. Use HTTPS (not HTTP) for web management.
— Encrypt management traffic with SNMPv3 (authPriv), not v1/v2c.
Additional hardening steps: Disable unused services and ports, change default credentials, enable logging, use NTP for time synchronization, segment management traffic to a dedicated management VLAN, use out-of-band management (dedicated management network).
Hardening Checklist
Change defaults → disable unused services → enable logging → use encrypted protocols (SSH, HTTPS, SNMPv3) → implement 802.1X → segment with VLANs → deploy firewall with default deny → enable port security → use NTP.
Key Terms
Key Terms
Knowledge Check — 12 Questions
Network Security — Hardening
A stateful firewall differs from a stateless ACL because:
- It is faster
- It tracks connection state and automatically permits return traffic
- It only works at Layer 2
- It uses community strings
- Answer: It tracks connection state and automatically permits return traffic
Stateful firewalls maintain a connection table — return traffic for established sessions is automatically allowed without explicit rules. A DMZ is used to:
- Connect branch offices
- Host public-facing servers isolated from the internal network
- Provide DHCP to guests
- Encrypt management traffic
- Answer: Host public-facing servers isolated from the internal network
The DMZ sits between the internet and internal network — public servers (web, mail) are accessible from the internet but cannot reach internal systems. Port security with “sticky” MAC addresses:
- Requires manual entry of all allowed MACs
- Dynamically learns and saves connected MAC addresses to the running config
- Blocks all traffic until 802.1X authenticates
- Requires a RADIUS server
- Answer: Dynamically learns and saves connected MAC addresses to the running config
Sticky MAC learning dynamically adds connected MACs to the port security config — no manual entry needed.
In 802.1X, the RADIUS server plays which role?
- Supplicant
- Authenticator
- Authentication Server
- Policy Enforcement Point
Answer: Authentication Server
RADIUS is the authentication server — it verifies credentials and tells the switch (authenticator) whether to grant access.
NAC posture assessment checks:
- Cable continuity
- Whether the device meets security requirements (patched, AV running)
- IP address assignment
- VLAN membership
- Answer: Whether the device meets security requirements (patched, AV running)
Posture assessment verifies device health — non-compliant devices are quarantined until they meet policy.
Telnet should be used instead of SSH for network device management because it is faster.
- True
- False
Answer: False
Telnet transmits data in plaintext — credentials and commands are visible to anyone capturing traffic. Always use SSH.
The principle of least privilege means:
- All users get admin access for efficiency
- Users receive only the minimum access required for their job
- Passwords must be at least 12 characters
- All ports are open by default
- Answer: Users receive only the minimum access required for their job
Least privilege limits access to only what is necessary — reduces the blast radius of a compromised account.
Which EAP method uses certificates on both the client and server (most secure)?
- PEAP
- EAP-MD5
- EAP-TLS
- EAP-TTLS
Answer: EAP-TLS
EAP-TLS requires certificates on both the supplicant and authentication server — the most secure EAP method.
Out-of-band management means:
- Managing devices via the production network
- Using a dedicated separate management network
- Disabling all management interfaces
- Using SNMP v1
- Answer: Using a dedicated separate management network
Out-of-band management uses a separate network (console servers, dedicated management VLAN) — management traffic never crosses the production network. A default deny firewall policy means:
- All traffic is allowed unless explicitly blocked
- All traffic is blocked unless explicitly permitted
- Only inbound traffic is blocked
- Only outbound traffic is permitted
- Answer: All traffic is blocked unless explicitly permitted
Default deny (implicit deny) blocks everything — administrators explicitly permit only required traffic. Much more secure than default allow.
Which protocol should replace SNMPv2c for secure device monitoring?
- SNMPv1
- SNMPv3 authPriv
- Telnet
- HTTP
Answer: SNMPv3 authPriv
SNMPv3 authPriv provides authentication (MD5/SHA) and encryption (AES) — SNMPv1/v2c use plaintext community strings.
A quarantine VLAN in a NAC deployment is used for:
- Isolating VoIP traffic
- Placing non-compliant devices with access only to remediation resources
- Hosting public-facing servers
- Guest internet access
- Answer: Placing non-compliant devices with access only to remediation resources
Non-compliant devices are quarantined — they can only reach patch servers and AV update servers until they meet policy.
Previous lesson: Network attacks: DoS/DDoS, MITM, ARP poisoning, VLAN hopping, DNS spoofing
Back to CompTIA Network+ Preparation
Next lesson: Wireless security threats: evil twin, deauthentication, WPS attacks, rogue APs