This objective focuses on defense-in-depth and the hands-on engineering solutions used to enforce security policies. Once you understand the types of attacks that threaten an infrastructure, you must apply specific hardening controls, segment networks into logical boundaries, and use automated systems to lock down both physical and virtual network access.
1. Device Hardening (The Baseline Defense)
Before implementing complex security software, you must ensure that individual network appliances (routers, switches, firewalls, servers) are inherently resilient against standard exploit attempts.
- Disable Unused Ports and Services: If a switch port or an active network protocol isn’t required for business operations, disable it. For example, disabling unnecessary services such as Telnet, HTTP management, or legacy routing protocols reduces the number of active entry points an attacker can exploit. Physically shutting down unused switch ports prevents an unauthorized insider or visitor from plugging an active device into an open wall jack.
- Change Default Passwords: Manufacturers ship devices with widely known, universal default credentials (e.g.,
admin/adminorcisco/cisco). Attackers use automated tools to try these defaults across thousands of IP addresses instantly. Changing these to complex, unique passwords—or completely switching to public key authentication- is the most elementary but frequently missed step in baseline security.
2. Network Access Control (NAC)
Network Access Control regulates access to network infrastructure based on device identity, user credentials, and endpoint compliance parameters.
Port Security
A Layer 2 switch feature configured directly on individual user access interfaces to restrict input traffic based on physical hardware addresses.
- How it works: It monitors incoming Ethernet frames and learns the MAC addresses associated with a port. You can configure a hard limit on the total number of MAC addresses allowed on a single interface (e.g., maximum of 1 MAC address per port).
- Violation Actions: If an unauthorized MAC address is detected (such as an attacker unplugging an office desktop and inserting their own laptop), the switch triggers a violation. It can instantly drop the unauthorized frames or enter a secure Shutdown state, completely disabling the interface until an administrator manually resets it.
802.1X (Port-Based Network Access Control)
While basic port security relies solely on easily spoofable MAC addresses, 802.1X is an international standard that requires users and devices to authenticate before a switch port transitions to an active state.
It relies on three explicit components to regulate access:
- Supplicant: The software client running on the user’s endpoint device (laptop or VoIP phone) that requests access to the network.
- Authenticator: The physical network switch or wireless access point blocking the client. It intercepts the user’s request, acting as a proxy gatekeeper. It keeps the user locked in a non-routable sandbox tier until their identity is verified.
- Authentication Server: The centralized corporate database backend (typically a RADIUS server). The authenticator forwards the user’s credentials to this server, which checks them against active directories and replies with an Access-Accept or Access-Reject token.
MAC Filtering
- What it is: A legacy access control list built into wireless routers or switches that contains an explicit list of approved MAC addresses.
- The Catch: Unlike 802.1X, MAC filtering provides very little actual security. Because Layer 2 hardware addresses travel completely unencrypted through the airwaves, an attacker with a basic wireless sniffing tool can easily capture an approved MAC address and spoof it on their own network card to bypass the filter within seconds.
3. Key Management
Cryptographic security relies on keys to encrypt data, sign digital certificates, and secure administrative SSH or VPN links. Key Management is the formal operational strategy for governing the full lifecycle of these mathematical assets.
- It dictates how keys are securely generated using strong random numbers, how they are securely distributed to authorized endpoints, where they are stored (such as inside specialized hardware security modules, or HSMs), and how frequently they must be automatically rotated to limit the impact if a key is covertly stolen.
4. Security Rules & Traffic Filtering
Filtering solutions sit along data paths to actively inspect traffic and block interactions that violate corporate security policy or represent known security threats.
Access Control Lists (ACLs)
- What it is: A sequential list of permit-or-deny rules configured on a router or firewall interface to inspect packet headers.
- How it works: It acts as a static gatekeeper. Standard ACLs filter traffic based strictly on the source IP address. Extended ACLs provide more granular control, evaluating the Source IP, Destination IP, Protocol type (TCP/UDP), and Port numbers simultaneously.
- The Golden Rule: ACLs are evaluated line by line, from top to bottom. The moment a packet matches a rule, the action (permit or deny) is taken, and the router stops checking further. Every ACL ends with an invisible, automatic rule known as the Implicit Deny—meaning if a packet fails to match any of your explicit permit rules, it is dropped by default.
Application-Layer Filtering
- URL Filtering: Restricts web browsing based on specific website link paths or categorical reputation lists (e.g., blocking access to gambling, social media, or known phishing domains at the corporate gateway).
- Content Filtering: Deeply inspects the actual payload data within packets or files as they move across the network. It scans for specific forbidden keywords, adult imagery, active executable scripts, or proprietary corporate data signatures to prevent unauthorized data leaks.
5. Security Zones & Network Topology Segregation
Dividing an enterprise infrastructure into distinct logical boundaries ensures that systems with different trust levels remain strictly isolated.
- Trusted vs. Untrusted Zones: The absolute baseline boundary. The Trusted Zone represents the internal corporate network where your local workstations, assets, and users reside. The Untrusted Zone represents everything outside your boundary that you do not control—primarily the public Internet.
Screened Subnet (DMZ)
- What it is: Historically referred to as a Demilitarized Zone (DMZ). It is a specialized, isolated buffer zone sitting directly between your trusted internal LAN and the completely untrusted public internet.
- Why use it: If a company wants to run a public web server, an email gateway, or an external DNS server, those systems must be accessible to public internet users. However, you never place a public-facing server directly inside your internal user LAN; if a hacker compromises that web server, they would immediately have free rein over your entire corporate network.
- The Architecture: You place public-facing servers inside the Screened Subnet. The corporate firewall applies tight security rules: public internet users are allowed to access the screened subnet on specific web ports, but traffic originating from the screened subnet is strictly blocked from ever entering or initiating conversations with the internal trusted LAN.
Security Features & Solutions Study Matrix
| Technology / Feature | Operational Layer | Primary Exam Identifier / Clue |
| 802.1X | Layer 2 Port Access | Port-based control using a Supplicant, Authenticator, and RADIUS Server. |
| Port Security | Switch Hardware | Restricts input based on MAC address count; can trigger port shutdown. |
| Extended ACL | Layer 3 / 4 Filtering | Sequential top-down rules evaluating IPs, protocols, and port numbers. |
| Implicit Deny | ACL Architecture | The automatic catch-all drop rule at the absolute bottom of an ACL. |
| Screened Subnet | Architecture / Topology | Houses public-facing servers; isolates external traffic from the private LAN. |
| URL Filtering | Application Layer | Restricts user web browsing based on domain category or path strings. |