Lesson 6 of 12 — Network & Infrastructure Security
Firewalls, IDS/IPS, DNS filtering, NAC, DLP, and endpoint security — the layered control stack that defends the enterprise network, and the defense-in-depth strategy that makes individual controls effective together.
In Lesson 5, you designed secure architectures — the blueprint. In this lesson, you populate that blueprint with the specific security controls that enforce it. Every enterprise network defense strategy relies on layering tools that detect, block, monitor, and respond at different points along an attacker's path. No single control stops every threat; a firewall cannot prevent an insider from emailing sensitive data, and a DLP solution cannot stop a port scan. The art is in selecting the right combination and understanding how they work together.
The Security Architecture domain tests your ability to do exactly this: read a scenario, identify which control addresses the specific threat described, and understand why the other options don't fit. This lesson teaches both the individual tools and the strategic framework — defense in depth — that connects them into a coherent enterprise defense posture. By the end of this lesson, you will be able to build a layered control map for any described enterprise environment and justify every control selection.
The network's gatekeepers — firewall types from packet filtering to NGFW, and the critical difference between detecting and blocking.
Firewalls enforce access control at the network boundary. NGFWs add application awareness and deep packet inspection. IDS alerts on threats; IPS blocks them inline. Detection methods: signature (known threats) vs. anomaly (behavioral deviation). False positives are the key operational challenge for IPS.
Controlling what domains users can reach, enforcing device compliance before network access, and preventing sensitive data from leaving the organization.
DNS filtering blocks malicious domains at the query level — no decryption needed. NAC verifies device compliance (patch level, AV status) before granting access. DLP monitors data in use, in motion, and at rest — preventing unauthorized exfiltration of classified or regulated data.
The last line of defense on every device — EDR, host firewalls, application control — and the enterprise defense-in-depth strategy that sequences all controls into a unified posture.
EDR moves beyond antivirus — behavioral monitoring, threat hunting, and containment at the device level. Application whitelisting prevents execution of unauthorized code. Defense in depth sequences controls from perimeter to endpoint so an attacker must defeat every layer. Analogize: concentric security rings around the data.
The network boundary enforcement and threat detection/prevention layer
The firewall is the foundational network security control — it decides which traffic is allowed into and out of a network segment. IDS and IPS extend that protection by analyzing traffic for attack signatures and behavioral anomalies. Together, they form the core of every enterprise network perimeter defense.
| Type | How It Works | Strengths | Limitations / When to Use |
|---|---|---|---|
| Packet Filtering Layer 3/4 |
Inspects individual packets based on source/destination IP, port, and protocol. No session awareness — each packet evaluated independently. | Very fast; low overhead; simple ACL-based rules. Still used in router ACLs for coarse-grained filtering. | Cannot detect split-packet attacks or maintain session state. Use for high-speed coarse filtering, not as primary defense. |
| Stateful Inspection Layer 3/4 |
Tracks the state of active connections in a state table. Only packets belonging to established, legitimate sessions are allowed through. | Understands TCP/UDP sessions; blocks unsolicited inbound packets; standard enterprise firewall for 20+ years. | Cannot inspect encrypted traffic or application-layer content. Cannot distinguish legitimate web traffic from attack traffic over port 80/443. |
| NGFW (Next-Generation Firewall) Layer 3–7 |
Combines stateful inspection with deep packet inspection (DPI), application identification, user identity awareness, SSL/TLS decryption, and integrated IPS. | Application control ("block Dropbox on corporate network"), user-based policies, threat prevention, SSL inspection. Industry standard for modern enterprise. | More expensive; SSL inspection raises privacy concerns; requires tuning. Use as the primary perimeter and internal segmentation firewall. |
| WAF (Web Application Firewall) Layer 7 |
Specifically protects web applications by inspecting HTTP/HTTPS request and response traffic. Enforces OWASP rules to detect SQLi, XSS, CSRF, and other application-layer attacks. | The only firewall type that protects against web application attacks (SQLi, XSS, SSRF). Can be deployed as inline hardware, software, or cloud service (AWS WAF, Cloudflare). | Only protects HTTP/HTTPS — not a general network firewall. Requires tuning to avoid blocking legitimate traffic. Use in front of every public-facing web application. |
| Proxy Firewall Layer 7 |
Acts as an intermediary — all traffic passes through the proxy, which establishes separate connections to both the client and server. Full content inspection possible. | Complete content inspection; SSL decryption for inspection; caching for performance; URL categorization and content filtering. | Adds latency; requires explicit or transparent configuration; modern HTTPS inspection adds certificate management complexity. Use for web content filtering and egress control. |
IDS monitors a copy of network traffic (via port mirroring / SPAN port) and generates alerts when suspicious patterns are detected. It is passive — it cannot block or modify traffic. Its value is in visibility and forensic logging.
IPS is deployed inline in the traffic path and actively blocks, drops, or resets connections that match threat signatures or behavioral anomalies. It is the active counterpart to IDS.
Compares traffic against a database of known attack patterns (signatures). Like antivirus for network traffic — highly accurate for known threats, zero false positives on mature signatures, but completely blind to zero-day and novel attacks.
Establishes a baseline of normal behavior and alerts when traffic deviates significantly from that baseline. Can detect zero-day attacks and novel threats — but generates more false positives because "unusual" is not always malicious.
Controlling domain access, enforcing device compliance, and preventing data exfiltration
These three controls address distinct attack vectors: DNS filtering stops connections to malicious domains before they reach the threat; NAC ensures only compliant, trusted devices connect to the network; DLP prevents sensitive data from leaving through authorized channels being misused. Together they close attack paths that firewalls and IDS/IPS cannot fully address.
Every internet connection begins with a DNS query — the device must resolve a domain name to an IP address before connecting. DNS filtering intercepts these queries and blocks resolution of domains that are classified as malicious, phishing, malware distribution, or policy-violating.
What it stops:
What it does NOT stop:
Analogy: DNS filtering is like a receptionist who checks whether the person you're calling is on a "known fraudsters" list before connecting your call — if the number is flagged, the call never goes through.
NAC evaluates every device attempting to connect to the network against a defined security policy before granting access. The evaluation (called a "posture assessment") checks whether the device meets compliance requirements.
Common policy requirements checked during NAC evaluation:
Quarantine VLAN: Devices that fail posture assessment are placed in a restricted VLAN with access only to a remediation server (Windows Update, AV update server). Once they meet compliance, they are moved to the appropriate production VLAN automatically.
Monitors data being transmitted over the network — email, web uploads, FTP, cloud sync. If a transmission contains content matching a DLP policy (e.g., a Social Security Number pattern, a document labeled "Confidential"), the DLP system can block, quarantine, or alert.
Scans data stored in file servers, databases, SharePoint, cloud storage repositories, and endpoint file systems for sensitive content that is misclassified or improperly stored.
Agent-based DLP deployed on endpoints monitors how users interact with sensitive data in real time — blocking or alerting on policy-violating actions at the device level.
The device-level security layer — and the enterprise strategy that connects all controls
The endpoint is where data lives, users work, and attackers ultimately want to land. Every attack — whether delivered via phishing, web exploit, or supply chain compromise — eventually executes on an endpoint. Endpoint security is the last line of defense when perimeter controls have been bypassed. Defense in depth is the strategic framework that ensures multiple lines of defense are always between an attacker and their goal.
EDR is the evolution of antivirus — instead of matching file signatures, EDR monitors endpoint behavior continuously: process creation, file system changes, registry modifications, network connections, and memory operations. It detects threats based on behavior, not signatures, enabling it to identify novel malware and advanced threats.
Application control enforces a policy of which software is allowed to execute on an endpoint. Whitelisting only permits explicitly approved applications — anything not on the list is blocked from running, regardless of whether it is known malware.
A software firewall running on each individual endpoint that controls inbound and outbound traffic at the device level — independent of any network firewall. Provides protection even when a device is on an untrusted network (home Wi-Fi, hotel, airport).
Two foundational endpoint security baselines that address different risk categories:
Full-disk encryption (FDE): BitLocker (Windows), FileVault (macOS) encrypt all data on the disk. If a laptop is stolen, the data is unreadable without the encryption key. Directly satisfies data-at-rest confidentiality requirements for most regulatory frameworks.
Endpoint patch management: The OS and all installed applications on every endpoint must be patched on a defined cadence. Unpatched endpoints are the primary initial access vector for both malware and human attackers exploiting known CVEs.
Defense in depth layers controls so that an attacker must defeat every layer to reach their goal. No layer is assumed to be impenetrable — each layer buys time for the next layer to engage and for defenders to detect and respond. Here is a representative enterprise defense-in-depth stack from the internet perimeter inward to the data:
First barrier — blocks unauthorized inbound and outbound traffic. Application-aware policies deny non-business traffic. SSL inspection decrypts HTTPS for deeper analysis. Defeats: network scanning, direct exploitation of internal services from internet.
Analyzes traffic that passes the firewall for attack signatures and behavioral anomalies. Inline IPS drops exploit traffic before it reaches internal systems. Defeats: known exploits, vulnerability scanning, protocol attacks.
Blocks user access to malicious domains and filters outbound web traffic through a proxy for content inspection. Defeats: phishing link visits, C2 callbacks, malware downloads, botnet beaconing.
Filters inbound and outbound email — strips malicious attachments, blocks phishing links, verifies DMARC/DKIM/SPF, and quarantines suspicious messages. Defeats: phishing, BEC, malware delivery via email attachment.
Only compliant, authenticated devices connect to the network. Segmentation limits lateral movement — a compromised workstation cannot directly reach the database server. Defeats: unauthorized device access, lateral movement post-compromise.
Behavioral monitoring, process control, and host-level traffic filtering on every endpoint. Even if an attacker lands on a device, EDR detects their tools and techniques; application control prevents unauthorized code execution. Defeats: fileless malware, living-off-the-land attacks, zero-day exploits.
The final protection layer around the data itself — encryption at rest and in transit, least-privilege access control, and DLP to prevent unauthorized exfiltration. Even if all other layers are bypassed, encrypted data with enforced access control limits the damage. Defeats: insider exfiltration, data theft post-compromise.
Security+ scenario questions frequently describe a threat and ask which control addresses it. Use this framework to match them:
Match each threat scenario to the security control that BEST addresses it
Select a real-world incident and identify which controls failed, which should have been deployed, and why
Select the best answer for each question, then submit for graded feedback
