CompTIA SY0-701: Network Security & Architecture — Study Guide
Part of the CompTIA Security+ SY0-701 — Complete Study Guide. Practice with verified answers in the CompTIA exam hub, or take timed practice tests on ExamRoll.io.
Network security architecture is the discipline of arranging devices, controls, and traffic flows so that malicious activity is contained, monitored, and blocked while legitimate business communication proceeds unimpeded. It combines policy expressed as rules, structural boundaries expressed as segmentation, and cryptographic protections expressed as tunnels — all reinforced by hardening at the host and port level.
Firewall Rules and Access Control Lists
A firewall rule, whether written on a stateful appliance or as a router ACL, evaluates traffic against a five-tuple: source address, destination address, source port, destination port, and protocol. Rules are processed top-down, and the first match wins. This ordering matters enormously. A rule permitting any any traffic placed above a specific deny rule renders that deny meaningless. Similarly, every well-designed rule set terminates with an implicit deny — an unwritten catch-all that drops anything not explicitly permitted.
Consider a policy that restricts outbound DNS so that only a designated internal resolver at 10.50.10.25 may query external servers on UDP/53:
access-list OUTBOUND permit udp host 10.50.10.25 any eq 53
access-list OUTBOUND deny udp any any eq 53
access-list OUTBOUND permit ip any any
The order is critical: the specific permit precedes the broad deny, and no other host can reach external DNS. To block a known-malicious inbound source such as 10.1.4.9, the corresponding inbound rule is straightforward:
access-list INBOUND deny ip host 10.1.4.9 any
Placed at the top of the inbound list, it ensures the address is dropped before any permit statements can match.
Firewalls can be configured to fail-open (allow traffic if the device fails) or fail-closed (deny all traffic). Fail-open preserves availability but sacrifices security; fail-closed does the opposite. The choice must be deliberate, informed by whether the segment prioritizes uptime (a manufacturing floor) or confidentiality (a payment processing enclave).
Segmentation, VLANs, and Geolocation Controls
Segmentation divides a flat network into smaller broadcast and trust domains. VLANs enforce Layer 2 separation on shared switches, while routed subnets and firewalls enforce Layer 3 boundaries. A typical enterprise separates user workstations, servers, VoIP phones, guest Wi-Fi, IoT devices, and management interfaces into distinct VLANs, each governed by inter-VLAN ACLs. Segmentation limits lateral movement: if ransomware detonates on a user VLAN, it cannot immediately pivot to the database VLAN without traversing filtered boundaries.
IP geolocation extends segmentation logically. If the business operates only in North America, firewall rules or geo-IP feeds can drop connections originating from other regions, drastically shrinking the attack surface for brute-force and reconnaissance traffic. Geolocation is not a substitute for authentication — attackers use VPNs and proxies — but it is an effective coarse filter.
Perimeter Devices: NGFW, IDS/IPS, and WAF
A next-generation firewall (NGFW) extends traditional stateful inspection with application awareness, user identity integration, TLS decryption, and threat intelligence feeds. Where a legacy firewall sees “TCP/443 to 8.8.8.8,” an NGFW sees “user jsmith using Dropbox to upload a file classified as PII.”
Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) analyze traffic against signatures and behavioral baselines. The critical distinction: an IDS is out-of-band and passive — typically fed by a SPAN port or network tap — and can only alert. An IPS is inline, sitting in the traffic path, and can drop, reset, or quarantine malicious flows in real time. Deploying an IDS where prevention is required leaves attacks visible but unmitigated; deploying an IPS without careful tuning risks blocking legitimate traffic. Choose based on the mission: monitoring and forensics call for IDS, active enforcement calls for IPS.
A Web Application Firewall (WAF) operates at Layer 7 and specifically understands HTTP/HTTPS semantics. It parses requests to detect SQL injection, cross-site scripting, and application logic abuse. A WAF is not a general-purpose IPS: it protects web applications specifically and is placed directly in front of web servers or embedded in a reverse proxy or CDN. Conversely, an IPS covers broader protocols but lacks the deep application context needed to catch a crafted UNION SELECT payload buried in a POST body.
Load Balancers and Content Filtering
Load balancers distribute client connections across a pool of backend servers using algorithms such as round-robin, least-connections, or weighted hashing. Beyond performance, they enable elastic availability: adding or replacing a backend server requires only updating the pool, with no client-visible disruption. This makes load balancers the go-to solution when the requirement is minimal operational effort to add or replace capacity. Modern load balancers also terminate TLS, perform health checks, and integrate with WAF and DDoS scrubbing services.
Content filters and secure web gateways inspect outbound user traffic, blocking access to categories such as malware, phishing, or policy-violating content, and often enforce DNS-layer filtering as an additional line of defense.
VPNs and Encrypted Tunnels
Virtual Private Networks provide confidentiality and integrity for traffic traversing untrusted networks. IPsec operates at Layer 3 and can protect any IP traffic; it uses IKE (Internet Key Exchange) for negotiation and either AH (Authentication Header, integrity only) or ESP (Encapsulating Security Payload, integrity and confidentiality). SSL/TLS VPNs operate at Layer 4–7, typically through a web browser or lightweight client, and are easier to deploy through NAT and firewalls than IPsec. WireGuard is a modern, minimal-codebase VPN protocol using Curve25519 for key exchange and ChaCha20-Poly1305 for encryption, offering significantly better performance than OpenVPN or IPsec in many scenarios.
Split tunneling routes only corporate-destined traffic through the VPN while internet traffic exits locally. This reduces VPN bandwidth load but means that internet-facing threats bypass corporate security controls. Full-tunnel VPN routes all traffic through the corporate gateway, enabling content filtering and DLP inspection at the cost of higher latency and bandwidth.
Practical Scenario: Lateral Movement via Flat Network
A professional services firm ran all workstations, servers, and printers on a single /16 subnet with no internal segmentation. When an attacker gained initial access through a phishing email on a junior analyst’s workstation, they used nmap to discover 847 reachable hosts, identified an unpatched Windows Server 2012 R2 file server, exploited MS17-010 (EternalBlue) to gain SYSTEM access, and then used that foothold to reach the domain controller. The entire lateral movement phase took under four hours. Had the network been segmented — workstations on a separate VLAN from servers, with inter-VLAN firewall rules permitting only necessary protocols — the analyst’s workstation would have been unable to reach the file server on SMB/445, and the attack chain would have been broken at the first pivot.
← Threats · All domains · Security Operations →
Practice these questions → · Timed practice on ExamRoll.io →
Pass the whole exam — not just this question
You found this answer. Get every verified question and explanation in one place, and save hours of prep. Free to start.
Pass your exam →