Network segmentation and zero trust
Domain 3: Security Architecture · Not started
Main exam topics
Cloud and on-premises systems; virtualization, containers and industrial systems; shared responsibility; secure infrastructure and communications; segmentation and firewalls; protecting data at rest, in transit and in use; encryption, DLP, backups, redundancy and recovery.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Why segment
Segmentation divides a network into zones so that a compromise in one area does not spread freely. VLANs separate traffic logically, firewalls control what crosses between zones, and a screened subnet (DMZ) hosts public-facing services away from internal systems. Payment systems, guest Wi-Fi, and industrial controllers are classic candidates for their own segments. Air gaps physically disconnect the most sensitive systems.
Firewalls and placement
Stateful firewalls track connections and allow return traffic automatically. Next-generation firewalls inspect applications and users, not just ports. Web application firewalls protect websites against attacks such as SQL injection. Rules are processed top-down, and a final implicit deny blocks anything not explicitly allowed. Test new rules both ways: confirm required traffic passes and confirm forbidden traffic is blocked.
Zero trust
Zero trust removes implicit trust based on network location. Every request is authenticated, authorized, and evaluated using identity, device health, and context. The control plane makes decisions through a policy engine and policy administrator; the data plane enforces them at a policy enforcement point. Micro-segmentation applies tight rules between individual workloads. A user on the office network is treated no differently from one at a coffee shop.
Secure remote access
VPNs encrypt traffic between remote users or sites, using IPsec or TLS. Jump servers give administrators one hardened, monitored path into sensitive segments. Network access control checks device posture before granting access.
Know the difference: Traditional perimeter vs. zero trust
| Aspect | Perimeter model | Zero trust |
|---|---|---|
| Trust basis | Network location | Identity, device, context |
| Verification | At the edge once | Every request |
| Lateral movement | Easy inside | Restricted by micro-segmentation |
Saved