Explain system and network architecture concepts in security operations

If you have come from Security+, the shift starts here. Security+ asked what is network segmentation. CySA+ asks what can I see, and what am I blind to, given how this network is built.

Every architecture choice is a visibility choice. That framing is the objective.

Log ingestion

Check yourself

Correlating a firewall log with a domain controller log shows the DC event occurring 4 minutes before the connection that caused it. What is the most likely explanation?

• The attacker manipulated the logs
• Clock drift between the two sources
• The firewall dropped the connection
• The DC was compromised first

Operating system concepts

Windows Registry — configuration and, for an analyst, a persistence hunting ground. Run and RunOnce keys are where malware survives reboots.

File structure — knowing where things normally live is what makes an anomaly visible. An executable in AppData\Roaming or %TEMP% is worth a second look; the same binary in Program Files is not.

System processes — you cannot spot a fake svchost.exe without knowing the real one's parent, path, and typical count. Malware routinely uses near-miss names.

System hardening — reduces attack surface, and also reduces the noise floor, which makes real anomalies stand out.

Infrastructure concepts

Virtualisation — hypervisor isolation, and the visibility question of whether you can see traffic between VMs on the same host.

Containerisation — shared kernel, so weaker isolation than VMs, and containers are ephemeral. That matters enormously for forensics: a container that exits takes its evidence with it unless logs were shipped off first.

Serverless — no OS to instrument. You lose host-level telemetry entirely and depend on whatever the provider exposes.

Network architecture

On-premises, cloud, hybrid — hybrid means two telemetry pipelines and a connection between them, and gaps usually live at the seam.

Network segmentation — limits blast radius, and gives you enforcement points where traffic can be observed.

Zero trust — no implicit trust by location; every request authenticated and authorised.

SDN — centralised network control, which also means centralised policy telemetry.

SASE — cloud-delivered security that follows the user, which is how you retain visibility once staff and applications both leave the office.

Identity and access management

Analyst framing again: identity is where most modern attacks land, so IAM telemetry is often your best detection source.

• MFA — and the fatigue attacks against push-based MFA
• SSO and federation — one compromise reaches many systems, so SSO logs are high-value
• Privileged access management — just-in-time elevation shrinks the window a stolen admin credential is useful
• Passwordless — removes the phishable credential entirely
• CASB — a cloud access security broker sits between users and cloud services, providing visibility and policy enforcement over SaaS that would otherwise be invisible

Encryption and its cost to visibility

PKI underpins trust. SSL/TLS inspection decrypts traffic so it can be examined — and it is the sharpest trade-off in the objective.

Check yourself

A SOC can see that a workstation opened a TLS session to an unfamiliar host and transferred 800 MB, but not what was sent. What do they have, and what would change that?

• Full payload; nothing needs to change
• Metadata only; TLS inspection would reveal content
• Nothing useful; the session is invisible
• Only DNS records; a firewall would reveal content

Sensitive data protection

DLP inspects data in motion, at rest and in use, and blocks sensitive content leaving. PII and cardholder data are the regulated categories driving most DLP policy, and knowing which category is involved determines who must be notified and how quickly — which is Domain 4's territory.