Network Components

Cheat sheet

Sharp facts the exam loves — scan these before test day.

Securing a network component means hardening the hardware layer, not the topology

Network Components owns the physical and near-physical pieces inside a network (power and support, transmission media, the NAC gate, and the endpoint) while segments, zones, and protocol layers belong to Secure Network Architecture. Treat each component as both a defense-in-depth layer and a potential single point of failure, so the goal for each is to make it resilient (keeps working through faults) and trustworthy (only authorized, healthy devices and signals pass). The exam tests these as engineering and operational decisions, not device configuration.

Redundancy runs from N+1 to 2N, and the level is a cost-versus-downtime call

Component redundancy is expressed from N+1 (one spare beyond what the load actually needs) up to 2N, a fully duplicated and independent path with no shared single point of failure. The level you pick is a cost-versus-availability decision driven by the cost of downtime, not a fixed standard, with intermediate options like N+2 or 2N+1. At the device level the same idea appears as high-availability clustering with failover (a partner takes over when the active unit dies) and load balancing (traffic spread so no one device is a bottleneck or sole failure point).

Trap Picking N+1 redundancy believing it removes the single point of failure, when only 2N gives a fully independent path with no shared component to fail.

A UPS bridges seconds to minutes; only a generator survives a prolonged outage

Redundant power is built in order: dual feeds and redundant supplies remove single-feed failure, power conditioning smooths noise and clamps spikes, a UPS (uninterruptible power supply) carries the load on battery through the seconds-to-minutes gap until the generator spins up, and the generator supplies sustained power for a prolonged outage from stored fuel. The UPS is bridge power, not long-run power, so its job is only to keep things alive until the generator takes over.

Trap Installing a larger UPS to ride out a prolonged blackout. More battery still cannot replace a generator, because a UPS only bridges the brief gap until sustained power arrives.

An out-of-support device is an unpatchable vulnerability. Plan its replacement

Once a vendor reaches end-of-life / end-of-support for a device, it stops receiving security patches and firmware, so it becomes an unfixable vulnerability no matter how high its uptime. The security-driven action is to plan the replacement before that date rather than wait for it to fail, which makes support contracts and lifecycle planning security controls, not just procurement hygiene. A maintained warranty matters because it guarantees an SLA-bound response window and a supply of spare parts.

Trap Keeping a high-uptime appliance in service past end-of-support because it still works. Uptime says nothing about whether it can still be patched against new vulnerabilities.

Copper carries electricity, so it radiates, suffers EMI and crosstalk, and attenuates

Twisted-pair copper carries an electrical signal, which has three security consequences: it radiates electromagnetic emanations a nearby attacker can read without touching the wire (the concern behind the U.S. TEMPEST emanation-security program), it is susceptible to electromagnetic interference (EMI) and to crosstalk where one pair's signal bleeds into an adjacent pair, and it attenuates so an unrepeated run is limited to roughly 100 meters. It can also be tapped by splicing the conductor.

Fiber carries light, so it emits nothing, ignores EMI, and is hardest to tap

Fiber-optic cable transmits pulses of light, inverting copper's weaknesses: it emits no electromagnetic signal (nothing to read at a distance), is immune to EMI and crosstalk, carries far greater bandwidth over far greater distance (kilometers for single-mode versus copper's ~100 m), and is the hardest medium to tap because intercepting the light means bending or breaking the fiber, which degrades the signal and is detectable. That makes fiber the strongest confidentiality and availability choice for backbone runs and links crossing space you do not physically control.

Trap Choosing shielded copper (STP) for an eavesdropping-sensitive run because shielding cuts emanation. It still carries an electrical signal and can be spliced, whereas a fiber tap degrades the light and is detectable.

STP and coax reduce EMI but stay electrical and tappable; only the shield differs from UTP

Unshielded twisted pair (UTP) has no electromagnetic shield, while shielded twisted pair (STP) and coaxial cable add a conductive shield that reduces EMI, crosstalk, and emanation at higher cost and stiffness. The shield is the only real difference: all of them still carry an electrical signal that can be tapped by splicing the conductor, so shielding hardens copper against interference and eavesdropping but never makes it tap-proof the way fiber is.

Trap Assuming shielded copper (STP or coax) is tap-proof because the shield blocks emanation, when the conductor still carries an electrical signal that can be spliced.

Cabling is a confidentiality control, so its physical plant is locked and logged

Because the medium itself carries data, its physical security is a control: cabling terminates in the central MDF (main distribution facility) and floor-level IDF (intermediate distribution facility) closets, and an open patch panel is an unmonitored tap onto the network, so those closets are locked, access-logged restricted areas. Runs through uncontrolled space go in locked conduits; NIST calls a hardened wireline/fiber cabling run with electromagnetic, acoustical, and physical safeguards a protected distribution system (PDS). Signal propagation quality (keeping runs within distance limits, away from EMI sources, and properly terminated) is both an availability and an integrity control.

1 question tests this

• A facilities security manager oversees an intermediate distribution frame (IDF) that houses both the telecommunications carrier's…

NAC admits a device only after it answers two questions: who are you and are you healthy

Network Access Control (NAC) is the gate that decides whether a device may join the network at all, and it enforces two independent checks at connection time: authentication (who/what is this device?) and posture assessment (is it healthy?). A device must satisfy both to reach production resources; passing one is not enough. NAC admits devices, which is distinct from Identity & Access Management proving a human user's identity.

Trap Admitting a device the moment it authenticates, when NAC also requires a passing posture check and authentication alone is not enough to reach production.

1 question tests this

• A security architect at a software company supports a remote workforce that connects to internal systems over a VPN from both personal and…

802.1X holds the port closed until the supplicant authenticates through the RADIUS server

IEEE 802.1X port-based network access control authenticates a device before its switch port or wireless association opens. Three roles cooperate: the supplicant (software on the connecting device), the authenticator (the switch or access point controlling the port), and the authentication server (typically RADIUS, holding policy and credentials). Until the supplicant authenticates (carried over EAP (Extensible Authentication Protocol)) the authenticator keeps the port closed to everything except the authentication exchange, moving the trust decision to the network edge.

4 questions test this

• A security architect at a manufacturing firm is closing a gap exposed by an audit: an attacker plugged a rogue device into an unused…
• A network security lead at a university is replacing flat, statically assigned VLANs with a NAC deployment. The objective is that the same…
• An organization is deploying 802.1X network access control to enforce endpoint compliance before granting network access. Which component…
• An organization wants to implement 802.1X authentication with dynamic VLAN assignment. Which component architecture correctly describes…

A device that authenticates but fails its health check goes to a quarantine VLAN, not denied

Authentication proves identity but says nothing about hygiene, so posture assessment separately evaluates patch level, antivirus/EDR state, firewall status, and configuration against policy. A device that authenticates yet fails the health check is steered into a quarantine / remediation VLAN with access limited to what it needs to fix itself (patch and AV servers), then re-checked and admitted once compliant, neither locked out entirely nor let onto production dirty.

Trap Outright blocking a known corporate device that fails its health check. It is owned and authenticated, so the correct move is remediation in a quarantine VLAN, not denial.

4 questions test this

• A network security manager at a hospital is hardening access for the clinical network after discovering that contractor laptops, often…
• A security engineer at an insurance company operates NAC that assesses endpoint posture at the moment of connection. Many employee laptops…
• An organization is deploying a NAC solution that should quarantine devices failing compliance checks until remediated. The NAC system…
• An organization implements NAC with 802.1X to dynamically assign devices to VLANs based on their compliance status. A laptop fails the…

Use agent-based NAC for managed fleets and agentless NAC for devices that can't run an agent

NAC reads posture two ways. Agent-based NAC installs a client (persistent or dissolvable) on the endpoint, giving deep, continuous posture data, the right call for managed corporate devices. Agentless NAC reads the device from the network (scanning, fingerprinting, DHCP/RADIUS attributes) with no software on it, which is the only option for unmanaged, BYOD, or IoT devices that cannot run an agent, at the cost of shallower, point-in-time inspection. Match the method to what you control, not to which inspects more.

Trap Mandating an agent for IoT or BYOD devices to get deeper posture. Those devices often cannot run one, so agentless inspection is the only way to admit them under policy.

2 questions test this

• A security manager at a law firm must enforce network access control for a steady stream of visiting auditors and partner attorneys who…
• A security operations lead at an energy company is extending network access control across a facility that includes many headless devices —…

Posture is checked at the door, so strong NAC re-assesses continuously

Posture is assessed at connection time, which means a device healthy when admitted can drift out of compliance afterward, a time-of-check versus time-of-use gap. Strong NAC deployments therefore re-assess continuously rather than only at admission, which is where NAC overlaps with the continuous-verification spirit of zero trust, though the zero-trust model itself belongs to Secure Network Architecture.

Trap Treating the admission-time posture check as sufficient, when a device can drift out of compliance after it is admitted and only continuous reassessment closes the time-of-check to time-of-use gap.

2 questions test this

• A security manager at a financial services firm has deployed NAC that checks endpoint compliance only at the moment of connection. An…
• An organization is deploying 802.1X network access control to enforce endpoint compliance before granting network access. Which component…

Hardening reduces attack surface up front via the least-functionality principle

Hardening is the provisioning-time work of removing what an attacker could use: uninstall unnecessary software, disable unused ports and services, close default accounts, and apply a secure configuration baseline such as a CIS Benchmark or DISA STIG. This is the least-functionality principle (configure a system to provide only mission-essential capabilities) and it pays off before any monitoring is installed because fewer enabled features means fewer flaws to exploit.

Trap Reaching for monitoring or detective controls to lower risk when the scenario calls for reducing attack surface up front, since hardening removes the vulnerable feature rather than just watching it.

1 question tests this

• A security team is hardening enterprise routers according to CISA guidelines. Which combination of actions BEST aligns with recommended…

A host-based firewall enforces rules at the device, even when network segmentation is bypassed

Where network firewalls and segmentation police traffic between zones, a host-based (personal) firewall enforces traffic rules at the individual device. That keeps a host protected when it is moved to an untrusted network or when internal segmentation is bypassed by a threat already inside. It is a per-device layer that complements the network firewall rather than replacing it.

Trap Treating a host-based firewall as redundant once network segmentation is in place, when it still protects the device on an untrusted network or after internal segmentation is bypassed.

EDR records and analyzes endpoint activity to catch what signature antivirus misses

Traditional antivirus matches files against signatures of known malware and misses novel or fileless attacks. Endpoint Detection and Response (EDR) instead continuously records endpoint activity (process, file, network, and registry events) and applies behavioural analytics to detect, investigate, and respond, giving responders the telemetry to isolate a compromised host and reconstruct what happened. The escalation questions reward: signature antivirus → EDR (behavioural, single endpoint) → XDR / managed detection (correlated across endpoints, network, and cloud).

Trap Reaching for signature antivirus when the scenario describes a novel, fileless, or behaviour-only threat. Signatures only catch known malware, so EDR is the tool that detects and contains the unknown.

The endpoint is the last independent layer, so it must defend itself after the network is crossed

Defense in depth only counts layers that fail independently. NAC controls whether a device joins, segmentation controls where its traffic goes, and endpoint controls protect the device after both have been crossed, which is exactly why endpoint security is not redundant with them. The endpoint terminates the connection and is where most compromise lands, so hardening, a host firewall, and EDR together make it a self-defending last hop rather than a soft target behind the perimeter.

Trap Treating endpoint controls as redundant with NAC and segmentation, when they fail independently and defend the device after both of those layers have already been crossed.

A stateful firewall lets return traffic in via its state table, not an inbound rule

Stateful inspection records each permitted outbound connection (source/destination IP, ports, connection state) in a state table. Reply packets are allowed because they match an existing session entry, and packets that falsely claim to belong to an established connection are dropped because no entry exists. State entries also let the firewall enforce HA failover via session-state replication and expire on idle timeout.

Trap If permitted return traffic is suddenly blocked, the state-table entry likely timed out (idle timeout). For UDP there is no handshake, so the firewall tracks only addresses/ports as a pseudo-session.

10 questions test this

• A security engineer is evaluating stateful firewall technologies for an organization that requires high availability. The engineer is…
• A security administrator notices that an internal host received a DNS response from an external server. When investigating the stateful…
• An organization's firewall administrator notices that when an internal host initiates an outbound TCP connection to an external server,…
• Marcus is troubleshooting why a client's response packet from an external web server is being blocked by the corporate stateful firewall.…
• An organization notices that its stateful firewall is experiencing performance degradation during peak traffic hours. Investigation reveals…
• A network administrator is reviewing a firewall's state table and notices entries containing source IP, destination IP, source port,…
• A stateful firewall maintains a state table to track network connections. Which information is MOST essential for the firewall to include…
• A security administrator notices that response traffic from external servers is automatically allowed through the organization's stateful…
• A network engineer is troubleshooting connectivity issues and discovers that long-running TCP sessions through a stateful firewall are…
• What is the key advantage that stateful inspection firewalls provide over stateless packet filtering firewalls when protecting against…

Browse all 10 questions →

A correct firewall ends in implicit deny. Anything not explicitly permitted is blocked

Best practice is deny-by-default: the firewall blocks all inbound and outbound traffic not expressly permitted by an allow rule, implementing least privilege. This implicit deny sits at the end of the ruleset, so only traffic matching a specific permit statement passes.

Trap Default-deny is the policy; rule ordering is separate. A too-broad permit placed before a specific deny can still let unwanted traffic through despite the final implicit deny.

8 questions test this

• A network administrator is reviewing the firewall policy for a new enterprise firewall deployment. When a packet arrives that does not…
• A network security team is implementing segmentation controls and wants to ensure that traffic cannot flow between VLANs without explicit…
• An organization is implementing a defense-in-depth strategy for its router infrastructure. CISA recommends implementing a specific ACL…
• An organization is implementing firewall rules and the security team debates the proper default policy. According to security best…
• A security administrator is configuring firewall rules and wants to ensure that any traffic not explicitly permitted is blocked. Which…
• An organization is configuring its stateful firewall ruleset. The security team wants to ensure traffic not explicitly permitted will be…
• An organization is configuring a new stateful firewall to protect its network perimeter. Which firewall configuration approach aligns with…
• A security architect is designing firewall rules for a new network segment. According to NIST guidelines, which approach should be…

Firewall and ACL rules are terminating and evaluated top-down. Order specific before general

Rules are processed sequentially (or by priority, lowest number first) and the first match wins, stopping further evaluation. Place specific rules (e.g. deny a malicious IP) before broader permits, and put high-hit rules early for performance. Layered firewalls also process by rule type (NAT first, then network, then application) so an early network-rule match can prevent Layer 7 application rules from ever running.

Trap A general permit placed above a specific deny silently overrides it; and a network-rule match terminates processing before application-layer filtering applies.

7 questions test this

• When configuring router ACLs, rules are processed sequentially and the first matching rule determines the action taken on the packet. A…
• An organization's firewall processes rules in the following order: DNAT rules first, then network rules, and finally application rules. A…
• During a firewall rule review, a security analyst discovers that a rule with priority 250 is matching traffic before a more specific rule…
• A security administrator is configuring ACLs on an enterprise router and needs to control which deny rule should be processed first when a…
• An organization is configuring firewall rule collections in a hierarchical policy structure. The firewall has multiple rule types including…
• When reviewing stateful firewall rule processing logic, a security architect discovers that network rules are applied before application…
• A firewall administrator is optimizing rule performance on a stateful firewall that processes rules sequentially. Which rule placement…

Signature detection catches known attacks; anomaly detection catches the unknown

Signature-based IDS/IPS matches traffic against a database of known attack patterns, so it has low false positives but cannot see zero-day or novel attacks with no signature. Anomaly-based detection flags deviations from a learned baseline, catching unknown attacks at the cost of more false positives. Combine both for the best coverage; counter known signature evasions with protocol normalization (decode encodings) and packet reassembly (defragment) before matching.

11 questions test this

• An organization has deployed a signature-based intrusion detection system (IDS) to monitor their network perimeter. The security team…
• A security analyst is investigating why the organization's network-based IDS failed to detect a recent attack. Upon review, the analyst…
• An organization's NIDS has detected a sophisticated attack that was not identified by signature-based detection but was caught by…
• A security architect is designing a defense-in-depth strategy for network threat monitoring. The organization faces threats from both…
• A financial institution is evaluating detection methodologies for their new intrusion detection system deployment. The security team wants…
• An attacker is attempting to evade network IDS detection by fragmenting malicious packets into smaller pieces that individually do not…
• An organization's security team discovers that attackers are using never-before-seen malware to infiltrate their network. Their current IDS…
• A security analyst is evaluating detection methodologies for the organization's new intrusion detection system. The analyst is concerned…
• A security analyst notices that the organization's IDS generates many alerts for legitimate deviations from normal behavior, requiring…
• An organization needs to detect sophisticated zero-day attacks from nation-state actors against their network infrastructure. Which IDS…
• An organization wants to improve detection accuracy while reducing false positives in their intrusion detection capabilities. Which…

Browse all 11 questions →

Anomaly detection only works after a representative training baseline

Anomaly-based detection compares activity to a profile of normal behavior built during a training period. Excessive false positives usually mean the baseline was too short or unrepresentative. Extending the training period to capture more legitimate variation is the fix before disabling alerts.

Trap A dynamic/auto-adjusting profile is exploitable: an attacker can ramp malicious activity slowly so the baseline drifts and accepts it as normal (baseline poisoning).

4 questions test this

• A security analyst notices that the organization's newly deployed anomaly-based IDS is generating an excessive number of alerts for…
• After deploying a new anomaly-based IDS, a security team is experiencing an overwhelming number of alerts. Investigation reveals that most…
• A security analyst is implementing an anomaly-based IDS for network monitoring. What is the MOST critical step required before the system…
• Before deploying an anomaly-based IDS in a production environment, what critical step must be completed to ensure accurate detection…

Stateful protocol analysis detects protocol misuse using vendor profiles

Stateful protocol analysis tracks the state of network, transport, and application protocols against vendor-developed profiles of how each protocol should behave, flagging deviations such as malformed requests or over-long arguments that span multiple events. It is the most resource-intensive detection method because of the per-session state tracking and deep inspection.

Trap It is not the same as a stateful firewall's connection table. Protocol analysis understands Layer 7 protocol semantics, not just connection state.

4 questions test this

• A network administrator is configuring a network-based IDPS that uses multiple detection methodologies. The administrator wants to enable a…
• A network security engineer is configuring an IDPS to detect HTTP protocol violations where attackers attempt to send malformed requests to…
• The security team notices their network-based IDPS is experiencing high resource consumption and processing delays during peak traffic…
• A network security engineer is evaluating IDPS detection methodologies for monitoring HTTP traffic. Which characteristic makes stateful…

WPA3-Personal uses SAE (dragonfly) to stop offline dictionary attacks and give forward secrecy

Simultaneous Authentication of Equals (SAE), the dragonfly handshake, replaces WPA2's PSK four-way handshake. Because authentication is interactive rather than derived from a captured handshake, attackers cannot run offline password guessing, and SAE provides forward secrecy so a later password compromise cannot decrypt previously captured traffic.

Trap SAE protects the password exchange and gives forward secrecy; protecting management frames against deauth is a separate WPA3 feature (PMF).

5 questions test this

• A security administrator is configuring wireless access points and wants to protect against offline dictionary attacks where attackers…
• A company has captured encrypted wireless traffic from their WPA3 network for legitimate monitoring purposes. An attacker later compromises…
• A security architect is upgrading corporate wireless access points to WPA3-Personal. Which authentication mechanism does WPA3-Personal use…
• A security architect is evaluating WPA3-Personal for a corporate wireless deployment. What authentication mechanism in WPA3-Personal…
• A security consultant is explaining the benefits of WPA3-Personal to stakeholders. Which security feature does SAE provide that WPA2-PSK's…

WPA3 makes Protected Management Frames mandatory, blocking deauth/disassociation attacks

Protected Management Frames (PMF, IEEE 802.11w) are mandatory in WPA3 (optional in WPA2). PMF adds integrity protection to management frames so attackers cannot forge deauthentication or disassociation frames to knock clients off the network or force a WPA2 downgrade.

Trap PMF defends management frames; offline-dictionary and forward-secrecy protection come from SAE, not PMF.

4 questions test this

• A security analyst discovers that wireless access points in transition mode are vulnerable to downgrade attacks where clients can be forced…
• A wireless network administrator notices that users are being forcibly disconnected from the network through deauthentication attacks.…
• A network administrator notices that WPA3-Enterprise has specific requirements beyond WPA2-Enterprise. What mandatory security feature does…
• A security architect is evaluating WPA3 security features for a new corporate wireless deployment. Which mandatory WPA3 requirement…

Harden SSH: disable v1, set PermitRootLogin no, use 3072-bit+ RSA keys

SSH v1 has known cryptographic weaknesses, so disable it and use only SSH v2 (modern OpenSSH supports protocol 2 only). Set PermitRootLogin no to force admins to log in as named users and escalate with sudo (accountability + least privilege), and use minimally 3072-bit RSA host keys (CISA/NSA guidance; FIPS requires at least 2048-bit) with SHA-2 signatures.

11 questions test this

• A security administrator is hardening SSH access on Linux servers across the enterprise. Which sshd_config directive should be configured…
• A security architect is configuring SSH for remote server management and wants to ensure the protocol meets current security requirements.…
• A security administrator is hardening SSH servers across the organization. According to security best practices, which configuration…
• A security administrator is hardening SSH configurations across the organization's Linux servers. According to security best practices,…
• During a security assessment, an auditor finds that the PermitRootLogin directive is set to 'yes' in the sshd_config file on production…
• A security architect is selecting SSH key algorithms for enterprise deployment. The organization requires FIPS compliance while maximizing…
• A security engineer is hardening SSH servers across the enterprise. According to CISA and NSA guidance, which configuration change is MOST…
• According to current CISA guidance on SSH hardening, which minimum RSA key size should be configured when implementing SSH for secure…
• A security team discovers that attackers have been exploiting SSH version 1 vulnerabilities to intercept administrative sessions. Which…
• An enterprise security team is implementing SSH hardening based on CISA recommendations. Which combination of settings represents the MOST…
• When hardening SSH servers for FIPS 140-2 compliance, which statement about cryptographic algorithm selection is CORRECT?

Browse all 11 questions →

Prefer SSH key authentication: PubkeyAuthentication yes, PasswordAuthentication no

Replace passwords with key-based auth by setting PubkeyAuthentication yes and PasswordAuthentication no, which eliminates brute-force password attacks since the private key never crosses the network. Store public keys in the user's ~/.ssh/authorized_keys (recommended 0600), and protect private keys with a passphrase so a stolen key is still useless without it.

Trap If the authorized_keys file, the ~/.ssh directory, or the home directory is group- or world-writable, sshd's StrictModes refuses key auth as a precaution against key injection.

7 questions test this

• An organization requires administrators to protect their SSH private keys stored on workstations. Which control provides the MOST effective…
• An organization is implementing SSH key-based authentication across its infrastructure. According to security best practices, what…
• An organization is implementing SSH key-based authentication to replace password authentication for administrator access. Where should the…
• An organization is implementing SSH key-based authentication to eliminate password-related vulnerabilities. Which configuration directive…
• A security administrator is hardening SSH configurations on Linux servers. Which configuration change provides the MOST effective…
• An organization wants to implement SSH key-based authentication and eliminate password authentication entirely. Which combination of…
• An enterprise security team is implementing SSH hardening based on CISA recommendations. Which combination of settings represents the MOST…

802.1X dynamic authorization places the same port into a VLAN by identity and posture

After 802.1X authentication, the RADIUS server returns Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID (the VLAN ID) so the switch dynamically assigns the port to a VLAN based on user identity and device compliance. The same physical port can land staff, students/guests, or non-compliant devices in different access levels; a failed or non-compliant device is steered to a guest/auth-fail/remediation VLAN rather than simply denied.

Trap Per-device certificates (not a shared network password) are what bind admission to enrolled, approved devices and stop credential sharing.

6 questions test this

• A network security lead at a university is replacing flat, statically assigned VLANs with a NAC deployment. The objective is that the same…
• An organization is deploying a NAC solution that should quarantine devices failing compliance checks until remediated. The NAC system…
• An organization implements 802.1X port-based network access control with a RADIUS server. When devices successfully authenticate, they need…
• An organization implements Network Access Control with 802.1X authentication on all switch ports. When the RADIUS server returns an…
• An organization implements NAC with 802.1X to dynamically assign devices to VLANs based on their compliance status. A laptop fails the…
• A company implements 802.1X port-based network access control. When a device fails authentication, it should still receive limited network…