Cybersecurity Network Security Syllabus

What is a DMZ (demilitarized zone) in network security?

A DMZ is a perimeter network segment that sits between the untrusted internet and the trusted internal LAN, hosting public-facing servers (web, mail, DNS) so that a compromise does not directly expose the internal network.

What is a screened subnet and how does it relate to a DMZ?

A screened subnet is the modern term for a DMZ implemented with two firewalls: an external firewall between the internet and DMZ, and an internal firewall between the DMZ and the internal network, giving layered protection.

What is a VLAN and at which OSI layer does it operate?

A VLAN (Virtual LAN) is a logically segmented broadcast domain within a physical switch infrastructure. It operates at Layer 2 (Data Link) and is defined by the IEEE 802.1Q tagging standard.

What is the purpose of the IEEE 802.1Q tag and how large is its VLAN ID field?

802.1Q inserts a 4-byte tag into the Ethernet frame to identify VLAN membership. The VLAN ID (VID) field is 12 bits, allowing $2^{12} = 4096$ VLANs (0–4095, with 1–4094 usable).

What is network segmentation and what security benefit does it provide?

Segmentation divides a network into isolated zones so traffic between them must pass through control points. It limits lateral movement, reduces the attack surface/blast radius, and supports least-privilege access and compliance (e.g., PCI DSS scope reduction).

What is VLAN hopping and name two techniques used to perform it?

VLAN hopping is an attack that lets traffic reach a VLAN it shouldn't. Two techniques: switch spoofing (attacker negotiates a trunk link via DTP) and double tagging (nesting two 802.1Q tags to jump VLANs).

What is Network Access Control (NAC) and what does it evaluate before granting access?

NAC enforces policy on devices attempting to join a network. Before granting access it evaluates posture/health (patch level, antivirus, configuration) and identity, often quarantining or remediating non-compliant devices.

What is the difference between agent-based and agentless NAC?

Agent-based NAC installs software on the endpoint to continuously assess posture in detail. Agentless NAC performs scanning from the network without installed software, offering less detail but easier deployment for unmanaged devices.

What is the difference between 802.1X and MAC Authentication Bypass (MAB) in NAC?

802.1X provides strong port-based authentication using a supplicant, authenticator, and RADIUS authentication server. MAB authenticates a device by its MAC address for endpoints (printers, IoT) that cannot run an 802.1X supplicant; it is weaker because MACs can be spoofed.

In 802.1X, what are the three roles and what protocol carries the authentication?

The supplicant (client), the authenticator (switch/AP), and the authentication server (RADIUS). Authentication is carried by EAP (Extensible Authentication Protocol), encapsulated as EAPOL between supplicant and authenticator.

What is Software-Defined Networking (SDN) and its three planes?

SDN decouples the control plane from the data plane, allowing centralized programmable network management. The three planes are the data/forwarding plane, the control plane (centralized controller), and the application/management plane.

What is a key security concern of the SDN control plane?

The centralized SDN controller is a single point of failure and a high-value target; compromising it could give an attacker control of the entire network. The northbound/southbound APIs (e.g., OpenFlow) must also be authenticated and encrypted.

Compare the three main firewall generations: packet-filtering, stateful, and next-generation (NGFW).

Packet-filtering (stateless) inspects individual packets by IP/port/protocol at Layers 3–4. Stateful firewalls track connection state in a session table. NGFW adds deep packet inspection, application awareness (Layer 7), IPS, and identity/user-based rules.

What is the difference between a stateless and a stateful firewall?

A stateless firewall evaluates each packet independently against static rules. A stateful firewall maintains a state table of active connections and allows return traffic that belongs to an established session automatically.

What is a Web Application Firewall (WAF) and what layer/threats does it address?

A WAF operates at Layer 7 to inspect HTTP/HTTPS traffic, protecting web applications against attacks such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats.

What is the default rule an effective firewall should end with (implicit deny)?

Implicit deny: any traffic not explicitly permitted by a rule is denied. The firewall rule base should terminate with a 'deny all' to enforce least privilege.

What is a forward proxy versus a reverse proxy?

A forward proxy sits in front of clients and forwards their outbound requests to the internet (used for filtering, caching, anonymity). A reverse proxy sits in front of servers and handles inbound client requests (used for load balancing, SSL termination, caching, hiding backend servers).

Name three security functions commonly performed by a reverse proxy.

SSL/TLS termination and offloading, load balancing across backend servers, and hiding/protecting backend server identity while enabling caching, WAF filtering, and DDoS mitigation.

What is the fundamental difference between an IDS and an IPS?

An IDS (Intrusion Detection System) is passive—it monitors and alerts on suspicious traffic (out-of-band, on a mirror/SPAN port). An IPS (Intrusion Prevention System) is active and inline—it can block or drop malicious traffic in real time.

Compare signature-based and anomaly-based detection in IDS/IPS.

Signature-based detection matches known attack patterns; it is accurate for known threats but misses zero-days. Anomaly-based (behavioral) detection flags deviations from a learned baseline; it can catch novel attacks but produces more false positives.

Define false positive and false negative in the context of an IDS.

A false positive is a legitimate/benign event incorrectly flagged as an attack. A false negative is a real attack that goes undetected (not flagged). False negatives are generally more dangerous.

What is the difference between a NIDS and a HIDS?

A NIDS (Network IDS) monitors network traffic at strategic points/segments. A HIDS (Host IDS) runs on an individual host and monitors that system's logs, files, and processes for suspicious activity.

What is a VPN and what two core security services does it provide?

A VPN (Virtual Private Network) creates an encrypted tunnel over an untrusted network. It provides confidentiality (encryption of traffic) and integrity/authentication of the endpoints, extending private network access securely.

Compare full-tunnel and split-tunnel VPN configurations.

In full tunnel, all client traffic is routed through the VPN, maximizing security/inspection but adding latency. In split tunnel, only corporate-bound traffic uses the VPN while internet traffic goes directly, improving performance but reducing visibility/control.

What are the two IPsec protocols AH and ESP, and what does each provide?

AH (Authentication Header, protocol 51) provides integrity and authentication but no encryption. ESP (Encapsulating Security Payload, protocol 50) provides confidentiality (encryption) plus integrity and authentication.

Compare IPsec transport mode and tunnel mode.

Transport mode encrypts only the packet payload, leaving the original IP header intact (used for host-to-host). Tunnel mode encrypts the entire original packet and adds a new IP header (used for site-to-site gateways).

What is a jump server (jump box / bastion host) and why is it used?

A jump server is a hardened, monitored host that acts as the single controlled entry point for administrators to access devices in a secure/isolated zone. It centralizes and audits access, reducing the attack surface by preventing direct connections to internal systems.

What is Secure Access Service Edge (SASE) and what two broad capabilities does it converge?

SASE is a cloud-delivered architecture that converges networking (SD-WAN) with security (network security as a service). It typically bundles SD-WAN, SWG, CASB, ZTNA, and FWaaS, delivered at the network edge close to users.

What is Zero Trust Network Access (ZTNA) and how does it differ from a traditional VPN?

ZTNA grants access per-application based on continuous identity and context verification ('never trust, always verify'), with no implicit network trust. Unlike a VPN, which grants broad network-level access after connecting, ZTNA hides resources and limits access to specific authorized applications.

List the 802.11 Wi-Fi standards a/b/g/n/ac/ax with their primary frequency bands.

802.11a: 5 GHz; 802.11b/g: 2.4 GHz; 802.11n (Wi-Fi 4): 2.4 & 5 GHz; 802.11ac (Wi-Fi 5): 5 GHz; 802.11ax (Wi-Fi 6/6E): 2.4, 5 & 6 GHz.

Compare the 2.4 GHz and 5 GHz Wi-Fi bands in terms of range and speed.

2.4 GHz offers longer range and better wall penetration but lower throughput and more interference/congestion. 5 GHz offers higher throughput and more channels but shorter range and weaker penetration.

Rank the Wi-Fi security protocols WEP, WPA, WPA2, and WPA3 from weakest to strongest and note key encryption.

WEP (weakest, RC4, broken IVs) < WPA (TKIP) < WPA2 (CCMP/AES) < WPA3 (strongest, SAE + AES-GCMP). Only WPA2 and WPA3 are considered acceptable today.

What is SAE in WPA3 and what attack does it defend against?

SAE (Simultaneous Authentication of Equals, aka Dragonfly) replaces the WPA2 pre-shared key handshake. It provides forward secrecy and resists offline dictionary/brute-force attacks by preventing capture-and-crack of the handshake.

What is the difference between WPA2/WPA3 Personal (PSK) and Enterprise modes?

Personal mode uses a shared pre-shared key (PSK/passphrase) for all users. Enterprise mode uses 802.1X with a RADIUS server for individual per-user authentication (EAP), providing unique credentials and centralized control.

What is a rogue access point?

A rogue AP is an unauthorized wireless access point connected to the network (often by an insider or attacker) without administrative approval, creating a backdoor that bypasses perimeter security controls.

What is an evil twin attack and how does it differ from a rogue AP?

An evil twin is a malicious AP that impersonates a legitimate one by cloning its SSID (and often a captive portal) to trick users into connecting, enabling credential theft and man-in-the-middle. A rogue AP is any unauthorized AP on the network; an evil twin specifically mimics a trusted SSID to deceive clients.

What is a deauthentication attack and why is it a precursor to an evil twin attack?

A deauth attack sends spoofed 802.11 deauthentication frames to force clients off a legitimate AP. It is used to disconnect victims so they reconnect—often to the attacker's evil twin—enabling handshake capture or MITM.

What is Bluejacking versus Bluesnarfing?

Bluejacking sends unsolicited messages to a Bluetooth device (relatively harmless). Bluesnarfing is the unauthorized access to and theft of data (contacts, messages, files) from a Bluetooth device—a serious data breach.

What is the typical range and frequency band of classic Bluetooth, and why does short range matter for security?

Classic Bluetooth operates in the 2.4 GHz ISM band with a typical Class 2 range of about 10 meters. The short range limits an attacker's proximity requirement, but it does not prevent attacks like bluesnarfing or bluebugging within range.

Compare passive and active RFID tags and note a key security concern.

Passive RFID tags have no battery and are powered by the reader's signal (short range); active tags have their own battery and longer range. A key security concern is skimming/eavesdropping and cloning, since many RFID tags transmit data without encryption or authentication.

What is an RFID relay (man-in-the-middle) attack, and what mitigations exist?

A relay attack captures an RFID/NFC signal and relays it in real time to a distant reader to impersonate the legitimate tag (e.g., keyless car entry). Mitigations include shielding (Faraday sleeves), distance-bounding protocols, encryption/mutual authentication, and requiring user action.