Secure network architecture and design principles tested on the Security+ exam, distinct from the general terms and threats decks.
41 cards · basic cards · AI-written, checked twice. Edit anything.
- What is a demilitarized zone (DMZ) in network architecture?
Show answer
A network segment that sits between an organization's internal network and an untrusted external network, hosting public-facing services while protecting internal systems from direct exposure.- What is the purpose of network segmentation?
Show answer
To divide a network into separate subnetworks, reducing attack surface by limiting lateral movement if one segment is compromised.- Define zero trust architecture.
Show answer
A security model that assumes no user, device, or network is inherently trustworthy; every access request requires authentication and authorization regardless of location or prior trust status.- What is defense in depth?
Show answer
A layered security approach using multiple defensive controls at different network levels so that failure of one control does not compromise the entire system.- What is a VLAN and how does it enhance security?
Show answer
A virtual local area network that logically partitions a physical network into separate broadcast domains, isolating traffic and preventing unauthorized cross-segment communication.- What is microsegmentation?
Show answer
A zero trust practice of dividing a network into very small security zones requiring separate access authorization, often down to individual workloads or applications.- What does a network access control (NAC) system do?
Show answer
Examines devices before allowing them onto the network, enforcing compliance policies and granting appropriate access levels based on device security posture.- What is the difference between a forward proxy and a reverse proxy?
Show answer
A forward proxy sits between clients and external servers, serving client requests; a reverse proxy sits between external clients and internal servers, serving server requests.- What is a transparent proxy?
Show answer
A proxy server that intercepts network traffic without requiring client configuration, appearing to handle traffic directly between endpoints.- What is content filtering and why is it used in network architecture?
Show answer
The inspection and blocking of network traffic based on content policies, used to prevent access to malicious sites, enforce acceptable use policies, and reduce data loss risks.- What role does a load balancer play in secure system design?
Show answer
Distributes incoming requests across multiple servers to prevent any single server from becoming a bottleneck or target, improving availability and resilience.- What is active-active clustering?
Show answer
A high availability configuration where all cluster nodes actively handle traffic simultaneously, with traffic automatically redirected to remaining nodes if one fails.- What is active-passive clustering?
Show answer
A failover configuration where one node actively serves traffic while backup nodes remain idle, taking over only when the active node fails.- What does redundancy in network architecture accomplish?
Show answer
Provides backup systems or paths so that if a primary component fails, operations can continue without interruption or with minimal service degradation.- What is a site-to-site VPN used for?
Show answer
Securely connects two geographically separated networks through encrypted tunnels, allowing resources at each site to communicate as if on the same LAN.
FlashKeepers