CompTIA Security+ Preparation · lesson 21 of 45 · 25 min
Network Security Architecture Fundamentals
Network security architecture is the design of network infrastructure to protect confidentiality, integrity, and availability. A well-designed architecture assumes attackers will breach the perimeter and uses layered controls to limit lateral movement and blast radius.
The Security+ exam tests your knowledge of segmentation, DMZ design, firewall types, network security devices, and secure network protocols.
Network Segmentation
Segmentation divides a network into isolated zones so that a breach in one zone cannot automatically spread to others. It is one of the most effective controls for limiting lateral movement.
DMZ design
A DMZ is created by placing a firewall between the internet and the DMZ, and another firewall between the DMZ and the internal network. Internet users can reach DMZ servers; they cannot directly reach internal servers. Internal users can reach both. This is called a screened subnet.
Firewall Types
Network Security Devices
Secure Network Protocols
Exam tip — insecure protocols
Know which protocols are insecure and their secure replacements: Telnet → SSH, FTP → SFTP/FTPS, HTTP → HTTPS, SNMPv1/v2 → SNMPv3, LDAP → LDAPS. The exam frequently asks you to identify the secure alternative.
Flashcard Drill
DMZ Demilitarized Zone — semi-trusted buffer zone between internet and internal network; hosts public-facing servers. NGFW Next-Generation Firewall — Layer 7 inspection + IPS + app/user ID + TLS decryption. IDS vs IPS IDS detects and alerts (passive). IPS detects and blocks (inline/active). NAC Network Access Control — enforces device health/posture checks before granting network access. Jump server Hardened bastion host used as the single access point to manage systems in a secure zone. Honeypot Decoy system designed to attract attackers and detect intrusion attempts. WAF Web Application Firewall — inspects HTTP/HTTPS traffic to protect web apps from SQLi, XSS, etc. SIEM Security Information and Event Management — aggregates logs and correlates events to generate alerts. SSH Secure Shell — encrypted remote access on port 22; replaces insecure Telnet (port 23). Screened subnet DMZ architecture using two firewalls — one between internet and DMZ, one between DMZ and internal network.
Scenario Practice
Designing the DMZ
Place the web server and email gateway directly on the internal network with firewall rules. Place the web server and email gateway in a DMZ (screened subnet) with firewalls on both sides. Place everything on the internet segment — it is simpler. Use only a WAF — no need for network segmentation. 1 A DMZ (screened subnet) isolates public-facing servers. If the web server or email gateway is compromised, the attacker is contained in the DMZ — a second firewall blocks direct access to internal systems.
IDS or IPS?
Deploy an IPS in blocking mode — it provides the strongest protection. Deploy an IDS in passive mode — it monitors and alerts without risking disruption to critical medical traffic. Deploy a WAF — it is the most comprehensive solution. Deploy a honeypot — it will attract attackers away from medical devices. 1 In environments where blocking could disrupt critical operations (healthcare, ICS), an IDS in passive mode is the safer choice. It provides visibility without the risk of accidentally blocking legitimate traffic. The IPS can be added later once signatures are tuned.
Knowledge Check
Network Security Architecture — 10 Questions
Which network zone hosts public-facing servers like web and email gateways, isolated from the internal network?
- Internal network
- Guest network
- DMZ
- Management network
Answer: DMZ
The DMZ (Demilitarized Zone) is the semi-trusted buffer zone that hosts public-facing servers.
Which firewall type can inspect application-layer content, identify users, and decrypt TLS traffic?
- Packet filter
- Stateful inspection
- Next-generation firewall (NGFW)
- Circuit-level gateway
Answer: Next-generation firewall (NGFW)
NGFWs operate at Layer 7 and can perform deep packet inspection, user/app identification, and TLS decryption.
An IPS is passive — it monitors traffic and generates alerts but does not block anything.
- True
- False
Answer: False
An IPS is active/inline — it can block malicious traffic. An IDS is passive and only alerts.
The secure replacement for Telnet that encrypts remote shell sessions on port 22 is called _____.
Answer: SSH
SSH (Secure Shell) encrypts remote access sessions. Telnet sends everything in plaintext.
A NAC system checks a device’s patch level and antivirus status before granting network access. This is called:
- Authentication
- Posture assessment
- Port scanning
- Vulnerability scanning
- Answer: Posture assessment
NAC performs posture assessment — checking device health (patches, AV, certificates) before granting access.
Which of the following are insecure protocols that should be replaced? (Select all that apply)
- Telnet
- SSH
- FTP
- HTTPS
- SNMPv1
Answer: Telnet
FTP
SNMPv1 Telnet (→SSH), FTP (→SFTP/FTPS), and SNMPv1/v2 (→SNMPv3) are insecure. SSH and HTTPS are already secure. A hardened server used as the single access point to manage systems in a secure network zone is called a:
- Honeypot
- Proxy server
- Jump server / bastion host
- Load balancer
- Answer: Jump server / bastion host
A jump server (bastion host) is a hardened, monitored single point of entry for administrative access to secure zones.
Which device aggregates logs from across the environment and correlates events to generate security alerts?
- IDS
- NAC
- SIEM
- WAF
Answer: SIEM
A SIEM (Security Information and Event Management) system collects, aggregates, and correlates logs to detect threats.
DNSSEC prevents DNS spoofing by digitally signing DNS responses.
- True
- False
Answer: True
DNSSEC adds cryptographic signatures to DNS records, allowing resolvers to verify responses have not been tampered with.
A WAF is specifically designed to protect against which types of attacks?
- Network-layer DDoS
- Physical intrusion
- Web application attacks like SQLi and XSS
- Ransomware on endpoints
Answer: Web application attacks like SQLi and XSS
A WAF (Web Application Firewall) inspects HTTP/HTTPS traffic and blocks web-specific attacks like SQL injection and cross-site scripting.
Previous lesson: Penetration testing concepts: reconnaissance, exploitation, post-exploitation, reporting
Back to CompTIA Security+ Preparation
Next lesson: Cloud security architecture: shared responsibility, CASB, CSPM