Network Segmentation and DMZ Design
Segmentation splits a network into isolated zones so that a compromise stays where it landed instead of moving sideways. VLANs separate broadcast domains, but on their own that is only separation: you still need filtering between them. Microsegmentation pushes the same idea down to individual workloads, and a DMZ isolates the services you deliberately expose to the public.
Exam tip. VLANs on their own are separation, not security. If nothing filters between them, inter-VLAN routing leaves them wide open, so look for the answer that adds firewall or ACL enforcement.
Firewall Types and Configuration
Firewalls filter traffic, but at very different depths. A stateless filter judges each packet on its own, a stateful firewall tracks whole connections, an NGFW adds application awareness and IPS, and a WAF works up at the HTTP layer. Whatever the type, default-deny with logging is the secure baseline.
Exam tip. If the scenario is identifying an app disguised on a standard port, plus integrated IPS, that is an NGFW. A WAF protects web apps at the HTTP layer, which a network firewall filtering by address and port cannot do.
Zero Trust Architecture
Zero Trust throws out the idea that being on the right network makes you trusted. Every request is authenticated, authorized, and encrypted, whether it came from inside or outside. Identity plus context becomes the real perimeter, verified continuously, with least-privilege access granted one application at a time.
Exam tip. Verification that does not care where you are, access granted per application, and posture checked continuously all point to Zero Trust. A VPN that hands you broad access the moment you connect is the opposite model.
Cloud Security: Shared Responsibility, CASB, CSPM
Cloud security runs on the shared responsibility model: the provider secures the infrastructure, and you always own your data, your access, and your configuration. That last part matters, because most cloud breaches are customer misconfigurations, which is exactly what CSPM, CASB, and CWPP exist to catch.
Exam tip. Shared responsibility always leaves the data and the configuration with the customer. An exposed storage bucket in IaaS is the customer's fault, not the provider's.
Virtualization and Container Security
Virtualization runs several isolated systems on one piece of shared hardware. A VM carries its own full kernel, which gives it stronger isolation, while a container shares the host kernel, which makes it far lighter but means an escape puts the host itself at risk. Either way you harden them the same way: least privilege and scanning.
Exam tip. Containers share the host kernel, so a container escape threatens the host and every sibling container. Full VMs isolate more but cost more overhead. When the question asks how to harden a container, the answer is least privilege.
VPN Technologies (IPsec, SSL/TLS, site-to-site, remote-access)
A VPN builds an encrypted tunnel across a network you do not trust. What you need to know is the difference between remote-access and site-to-site, the difference between IPsec and SSL/TLS, and the trade-off between split and full tunneling. Inside IPsec, ESP is the part that gives you confidentiality, while AH only authenticates.
Exam tip. If a question wants a confidential IPsec tunnel, the answer is ESP, not AH. And remember what full tunneling buys you: the endpoint cannot bridge to an untrusted network, and all of its traffic can be inspected.
IDS vs IPS vs SIEM vs SOAR
These four get confused constantly. An IDS detects and sits out of band, an IPS sits inline and can block, a SIEM correlates logs, and SOAR automates the response. Underneath them, detection is either signature-based, which catches the known, or anomaly-based, which catches the novel.
Exam tip. On a latency-sensitive or fragile network, an inline IPS that fails or false-positives can disrupt operations, so a detection-only IDS is often the safer choice.
OT/ICS/SCADA Security
Operational technology controls physical processes, so its priorities flip: availability and safety come first, confidentiality second. These systems tend to be fragile, unpatchable, and in service for decades, which is why they lean on compensating controls, segmentation, tight access, and passive monitoring.
Exam tip. Critical OT you cannot patch calls for compensating controls: segmentation, strict access, and passive monitoring. Never put it on the internet, and never run an intrusive scan against it.