Network Infrastructure

• A UPS bridges the gap; a generator carries a prolonged outage
• Keep data-center humidity in a band, roughly 40 to 60 percent
• A pre-action sprinkler is the data-center default because one broken head will not flood the room
• CO2 fire suppression is for unoccupied spaces only
• Express spare capacity as redundancy: N+1 adds one spare, 2N fully duplicates
• An MOU states intent; an MOA spells out specific obligations
• Put sensitive equipment in the building's interior core
• Defense in depth layers independent controls
• Segmentation limits lateral movement, with VLAN cheapest and physical strongest
• Put internet-facing servers in a DMZ to isolate a compromise
• A VPN gives a protected tunnel over an untrusted network
• NAC enforces two gates: authentication and posture
• NAC, not IAM, is the control for unmanaged IoT devices
• Cloud responsibility slides with the service model
• The provider secures of the cloud; the customer secures in the cloud
• Know the cloud deployment models: public, private, hybrid, community
• An SLA is the provider's measurable commitment, most visibly uptime
• Outsourcing to an MSP does not outsource accountability
• A TLS certificate proves the server's identity by chaining to a trusted root CA, blocking MitM
• The root CA is the trust anchor, so compromising it invalidates every certificate beneath it
• DNSSEC digitally signs DNS data to authenticate its origin and prove integrity
• Subnetting and VLANs into security zones limit an attacker's lateral movement
• VPN split tunneling sends internet traffic outside corporate security controls

Unlock with Premium — includes all practice exams and the complete study guide.