Secure network architecture and design principles tested on the Security+ exam, distinct from the general terms and threats decks.
41 cards · basic cards · AI-written, checked twice. Edit anything.
- What is a demilitarized zone (DMZ) in network architecture?
- A network segment that sits between an organization's internal network and an untrusted external network, hosting public-facing services while protecting internal systems from direct exposure.
- What is the purpose of network segmentation?
- To divide a network into separate subnetworks, reducing attack surface by limiting lateral movement if one segment is compromised.
- Define zero trust architecture.
- A security model that assumes no user, device, or network is inherently trustworthy; every access request requires authentication and authorization regardless of location or prior trust status.
- What is defense in depth?
- A layered security approach using multiple defensive controls at different network levels so that failure of one control does not compromise the entire system.
- What is a VLAN and how does it enhance security?
- A virtual local area network that logically partitions a physical network into separate broadcast domains, isolating traffic and preventing unauthorized cross-segment communication.
- What is microsegmentation?
- A zero trust practice of dividing a network into very small security zones requiring separate access authorization, often down to individual workloads or applications.
- What does a network access control (NAC) system do?
- Examines devices before allowing them onto the network, enforcing compliance policies and granting appropriate access levels based on device security posture.
- What is the difference between a forward proxy and a reverse proxy?
- A forward proxy sits between clients and external servers, serving client requests; a reverse proxy sits between external clients and internal servers, serving server requests.
- What is a transparent proxy?
- A proxy server that intercepts network traffic without requiring client configuration, appearing to handle traffic directly between endpoints.
- What is content filtering and why is it used in network architecture?
- The inspection and blocking of network traffic based on content policies, used to prevent access to malicious sites, enforce acceptable use policies, and reduce data loss risks.
- What role does a load balancer play in secure system design?
- Distributes incoming requests across multiple servers to prevent any single server from becoming a bottleneck or target, improving availability and resilience.
- What is active-active clustering?
- A high availability configuration where all cluster nodes actively handle traffic simultaneously, with traffic automatically redirected to remaining nodes if one fails.
- What is active-passive clustering?
- A failover configuration where one node actively serves traffic while backup nodes remain idle, taking over only when the active node fails.
- What does redundancy in network architecture accomplish?
- Provides backup systems or paths so that if a primary component fails, operations can continue without interruption or with minimal service degradation.
- What is a site-to-site VPN used for?
- Securely connects two geographically separated networks through encrypted tunnels, allowing resources at each site to communicate as if on the same LAN.