Study guide 5: Secure enterprise network architecture
Domain 3: Security Architecture · Not started
Main exam topics
Cloud and on-premises systems; virtualization, containers and industrial systems; shared responsibility; secure infrastructure and communications; segmentation and firewalls; protecting data at rest, in transit and in use; encryption, DLP, backups, redundancy and recovery.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Lesson plan · 90 minutes
By the end of this lesson you will be able to:
- Design zones, VLANs and screened subnets
- Choose firewalls, IDS/IPS, proxies and load balancers by placement
- Explain port security and 802.1X
- Secure remote access with VPNs, IPsec and jump servers
Topic 5A — Architecture
Segment networks into zones by trust level. A screened subnet (DMZ) hosts public services between external and internal firewalls. VLANs separate traffic on shared switches. Port security limits MAC addresses per port, and 802.1X uses a RADIUS server to authenticate devices before granting network access. Consider attack surface, single points of failure, latency and cost when choosing an architecture.
Topic 5B — Appliances
Packet-filtering firewalls check addresses and ports; stateful firewalls track connections; next-generation firewalls and WAFs inspect application content. An IDS detects and alerts; an IPS sits inline and blocks. Devices are placed inline or via a tap/SPAN. Fail-open keeps traffic flowing on failure; fail-closed blocks it. Proxies mediate web traffic; load balancers spread load and add resilience. A jump server is a hardened host for administering a secure zone.
Topic 5C — Secure communications
Remote-access VPNs connect users; site-to-site VPNs connect offices. TLS VPNs work through browsers; IPsec uses AH for integrity and ESP for confidentiality, in transport or tunnel mode. SSH replaces Telnet for administration. SD-WAN and SASE deliver secure connectivity and cloud-delivered security for distributed sites. Out-of-band management keeps admin traffic off the production network.
Saved