Security+ topic 3.2
Infrastructure Security Architecture
Networks are divided into security zones, such as a screened subnet (DMZ) for public servers, so a breach in one zone does not reach everything. Device placement and failure modes matter: a device that fails open keeps traffic flowing, while one that fails closed blocks it. Firewalls filter traffic, from packet filters to next-generation firewalls (NGFW) and web application firewalls (WAF). Intrusion detection systems (IDS) alert, while intrusion prevention systems (IPS) sit inline and block. VPNs and IPsec protect traffic over untrusted networks, 802.1X checks devices before they join, and jump servers and proxies control admin and web access. Security Service Edge (SSE) delivers these protections from the cloud for remote users.
Infrastructure Security Architecture vocabulary
- Screened subnet: A network zone between the internet and the internal network for public-facing servers, also called a DMZ.
- Fail closed: When a security device fails, it blocks traffic instead of letting it through.
- IPS: An intrusion prevention system that sits inline and blocks detected attacks.
- Jump server: A hardened server that admins connect to first before reaching sensitive systems.
Exam-style practice questions
Try each one, then open the answer. To save your progress, take this quiz in the interactive course.
1. A company wants its public web server reachable from the internet without exposing the internal network. Where should the server be placed?
- (A) On the internal user network
- (B) In a screened subnet
- (C) On the same network as the database
- (D) On a guest Wi-Fi network
Show answer
(B) In a screened subnet A screened subnet (DMZ) separates public servers from internal systems.
2. Which of the following devices sits inline and automatically blocks traffic that matches an attack signature?
- (A) IDS
- (B) IPS
- (C) Network tap
- (D) Port mirror
Show answer
(B) IPS An IPS is inline and blocks; an IDS only alerts.
3. Administrators must connect to a hardened server first before they can manage production databases. Which of the following is this server?
- (A) A jump server
- (B) A honeypot
- (C) A proxy for students
- (D) A domain controller
Show answer
(A) A jump server A jump server is the controlled entry point for admin access.
4. A company wants to protect its online store from SQL injection and cross-site scripting. Which of the following is the best choice?
- (A) A web application firewall
- (B) A UPS
- (C) A packet sniffer
- (D) A VPN concentrator
Show answer
(A) A web application firewall A WAF inspects web traffic for application attacks.