Domain 4 of 5 · Chapter 2 of 3

Understand Network Security Architecture

Unlock the complete study guide + 12 practice exams totaling 1,500 questions.

Bundled into the existing Certified in Cybersecurity premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Three questions behind network security architecture
  • Trust zones at the edge: external, DMZ, internal
  • Internal segments: boundaries inside the organization
  • VLANs: logical separation on shared switches
  • Micro-segmentation: a boundary around each workload
  • What a segment boundary does not do
  • Defense in depth: layered, complementary controls
  • Detection and response: when prevention misses
  • Zero Trust: the principles behind the model
  • How a Zero Trust access decision works
  • Adopting Zero Trust: principles, not a product

Network segmentation vs defense in depth vs Zero Trust

AspectNetwork segmentationDefense in depthZero Trust
Question it answersWhich systems may communicate with which?What still protects us when one control fails?Should this specific request to this resource be allowed?
What it protectsSegments: the DMZ and other edge zones, internal segments, micro-segmentsThe whole organization, through several independent layersEach resource, one session at a time
Typical mechanismsFirewalls between zones, VLANs with filtering between them, micro-segmentationLayers: network filtering, endpoint protection, application access control, physical protection, detection and response; built from people, processes and technologyPer-request authentication and authorization, device posture checks, dynamic policy, secured communication
What it does not doEncrypt traffic, or filter traffic that bypasses the boundaryMake any single layer infallibleCome from one product purchase or from MFA alone
Tempting wrong answerAn Internet-edge firewall alone to stop movement between internal systemsOne stronger perimeter appliance replacing the other layersTrusting a device because it has an internal network address

Decision tree

Step 1: choose the segmentPublic-facing server,such as web or email?DMZcommon placementYesNoVisitors needingInternet access only?Guest networkseparate segmentYesNoInternal segmentVLAN with filtering, or internal firewallStep 2: for a system in any segmentIndividual workloadsmust be restricted?Micro-segmentationboundary per workloadYesSegment boundaryno per-workload boundaryNoAlways: Zero Trust still evaluates each request, and defense in depth adds layers
Cheat sheet

Cheat sheet

  • The external Internet is the least-trusted zone in a conventional three-zone layout
  • A DMZ separates public-facing services from sensitive internal systems
  • Internal security boundaries separate systems with different access requirements
  • A security boundary must account for alternate entry paths
  • VLANs separate logical networks on shared physical infrastructure
  • Segmentation limits how far a compromise can spread
  • Micro-segmentation protects individual resources or small resource groups
  • AI development environments should be isolated from sensitive production data
  • Guest network access should be separated from internal business access
  • Network separation and encryption protect different properties
  • Defense in depth avoids depending on a single security barrier
  • Defense in depth combines people, processes, and technology
  • Physical protection prevents access paths that network rules cannot control
  • Detection and response complement preventive network controls
  • Zero Trust grants no implicit access based on network location or device ownership
  • Zero Trust access is limited to the resource and session being authorized
  • A valid user identity does not replace assessment of device security
  • Zero Trust can change access when risk or context changes
  • Zero Trust protects communications even on an internal network
  • Zero Trust depends on knowing the resources and access relationships being protected
  • Zero Trust is a set of security principles rather than one product

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://www.isc2.org/certifications/cc/cc-certification-exam-outline
  2. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf
  3. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf
  4. https://csrc.nist.gov/glossary/term/demilitarized_zone
  5. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-153.pdf
  6. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218A.pdf
  7. https://csrc.nist.gov/glossary/term/virtual_local_area_network
  8. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-125B.pdf
  9. https://csrc.nist.gov/glossary/term/service_set_identifier
  10. https://csrc.nist.gov/glossary/term/defense_in_depth
  11. https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
  12. https://csrc.nist.gov/glossary/term/intrusion_detection_system
  13. https://csrc.nist.gov/glossary/term/intrusion_prevention_system
  14. https://csrc.nist.gov/glossary/term/zero_trust