Given a scenario, apply security principles to secure enterprise infrastructure
Device placement, security zones, failure modes, and selecting the right control for the traffic you need to govern.
- Reading time
- 26 min read
- Flashcards
- 16 cards
- Practice questions
- 8 questions · 3 PBQs
Where 4.5 asked which device solves this problem, 3.2 asks where does it go and how should it behave. Two ideas carry most of the marks: failure modes and placement.
Failure modes
What happens when a security device fails or is overwhelmed?
Fail-open (fail-safe)
- Traffic continues to flow
- Availability preserved
- Security is lost during the failure
Fail-closed (fail-secure)
- Traffic is blocked
- Security preserved
- Availability is lost during the failure
The tellOpen means traffic keeps flowing. Closed means it stops. Which is correct depends entirely on what the system does.
Check yourself
An electronic door lock system controls exit from a laboratory. During a power failure, which failure mode should it use?
Device attributes
Two pairs, and they are not the same distinction:
Active vs passive
- Active — takes action, blocks
- Passive — observes only, alerts
Inline vs tap/monitor
- Inline — sits in the traffic path
- Tap/monitor — receives a copy
The tellOnly an inline device can block, so an active device must be inline. A tap can never do more than observe, whatever the software wants.
This is the IDS/IPS distinction from 4.5 stated architecturally: an IPS is active and inline, an IDS is passive and on a tap or SPAN port.
Security zones and placement
The classic three-zone model:
- Untrusted — the internet
- DMZ (screened subnet) — public-facing servers, reachable from outside but separated from internal systems
- Trusted — the internal network
A DMZ exists so that compromising a public web server does not put the attacker on the internal network. Anything the public must reach goes there.
Placement rule: put each control where it can see what it needs to inspect. A WAF belongs in front of the web servers it protects, not at the internet edge inspecting traffic for services it knows nothing about.
Jump server (bastion host)
The single hardened, monitored entry point into a sensitive zone. All administrative access flows through it.
Proxy server
Sits between clients and external services, forwarding and often filtering requests. A forward proxy serves internal clients going out; a reverse proxy sits in front of servers receiving traffic in.
Load balancer
Distributes traffic across servers for availability and performance. Also a high-availability control — see 3.4.
Sensors
Collection points feeding monitoring, placed where visibility is needed.
Port security
802.1X authenticates devices before granting network access — the same protocol behind WPA3-Enterprise (4.1). EAP is the framework it uses to carry the actual authentication method. Port security on a switch limits which MAC addresses may use a physical port.
Secure communication and access
VPN
An encrypted tunnel over an untrusted network. Site-to-site connects two networks permanently; remote access connects an individual user to the network.
IPSec
- Operates at the network layer
- Protects all traffic between endpoints
- Typical for site-to-site VPNs
TLS
- Operates above transport
- Protects specific application traffic
- Typical for remote access and web
The tellIPSec secures the network path. TLS secures the application session.
SD-WAN
Software-defined wide area networking. Manages links between sites centrally, routing traffic over whichever connection is best.
SASE
Secure Access Service Edge. Combines SD-WAN with cloud-delivered security — firewall, secure web gateway, zero trust access — so protection follows the user rather than the office. The natural architecture once staff are remote and applications are in the cloud.
Check yourself
A company with many remote staff and cloud applications wants security enforced consistently regardless of where users connect from. Which architecture fits?
Selecting effective controls
The recurring judgement: match the control to what it can actually see, place it where the traffic passes, and choose a failure mode based on what the system protects.