The OSI Model and Layer-Mapped Security Controls
The OSI model is a seven layer reference for describing what happens to data as it moves across a network, and the exam uses it as a filing system for everything else in this domain. Questions rarely ask you to recite the layers. They describe a device, a protocol or an attack and expect you to place it correctly, because placing it correctly is what tells you which control applies. Getting comfortable with which layer adds which header, and which device reads which header, converts a large amount of this domain into recall you can do quickly.
Exam tip. When a question names a device or protocol, place it on a layer before choosing an answer, because the control has to operate at or above the layer of the problem. A switch cannot filter on IP address and a packet filter cannot see application content, so any option asking a device to inspect something above its layer is wrong.
IPSec: AH, ESP, Tunnel and Transport Modes
IPSec is a suite that secures IP traffic at layer 3, which means it protects everything above it without applications needing to know. It has two protocols and two modes, and the exam tests all four combinations. The protocol choice decides which security services you get: AH authenticates but does not encrypt, ESP encrypts and can also authenticate. The mode choice decides how much of the original packet is protected: transport mode secures the payload only, tunnel mode wraps the entire original packet inside a new one. Site to site VPNs are the classic case, and they use ESP in tunnel mode.
Exam tip. If a question needs the traffic to be unreadable, the answer is ESP, because AH never encrypts anything. If it needs internal IP addressing hidden, the answer is tunnel mode. Any scenario involving NAT rules out AH, and a site to site VPN over the internet is ESP in tunnel mode.
Firewall Types and Network Segmentation
Firewalls differ by how deeply they can look into traffic, and that depth is exactly the trade-off against performance. A packet filter reads addresses and ports and nothing else, which makes it fast and easy to fool. A stateful firewall tracks whether a packet belongs to an established conversation. A proxy terminates the connection entirely and rebuilds it, so it can inspect content but becomes a bottleneck. Segmentation then takes those devices and uses them to divide the network into zones, so that a compromise in one area does not automatically give an attacker the rest.
Exam tip. Match the required inspection depth to the firewall type. If the question needs filtering on the content of a request or on a specific application command, only a layer 7 proxy or next generation firewall can do it. If the question complains about performance under load, the answer usually moves down the layers, and if it complains that spoofed packets got through, the answer is stateful inspection.
Wireless Security: WPA2, WPA3 and Enterprise Authentication
Wireless removes the physical boundary that once did a lot of quiet security work, because an attacker no longer needs to be in the building to be on the medium. The protections have gone through clear generations, and the exam expects you to know why each one was replaced. WEP failed structurally, WPA with TKIP was a stopgap on the old hardware, WPA2 brought AES-based CCMP, and WPA3 fixed the remaining weakness in how the shared password is used. Layered over that is the personal versus enterprise choice, which is really a question of whether every user has their own credential.
Exam tip. If a question involves individual accountability, per-user revocation or a departing employee, the answer is enterprise mode with 802.1X, not a stronger passphrase. Hidden SSIDs and MAC filtering are never the correct security answer, and if the scenario captures a handshake and cracks it offline, the fix is WPA3.
Network Attacks and Secure Protocol Choices
A large share of network security questions come down to one observation: the original internet protocols were designed for a trusted network and carry no authentication or encryption at all. That is why so many attacks are variations on lying about identity, and why so many correct answers are simply the secure replacement for a plaintext protocol. Learn the attack families by what they abuse rather than by name alone, and learn the secure substitutes as pairs, because the exam very often gives you an insecure protocol in the stem and expects its modern replacement in the answer.
Exam tip. When an insecure protocol appears in the stem, scan the options for its direct secure counterpart before considering anything else, because that is usually the intended answer. Remember that DNSSEC provides authenticity and integrity for records but not confidentiality, which is a frequently used distractor.