Study guide 9: Network security capabilities
Domain 4: Security Operations · Not started
Main exam topics
Hardening; asset and vulnerability management; monitoring and alerting; identity and access management; automation; firewalls and endpoint protection; log interpretation; incident detection, containment, eradication and recovery; forensic evidence and chain of custody.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Lesson plan · 60 minutes
By the end of this lesson you will be able to:
- Apply secure baselines and benchmarks
- Configure WPA3, 802.1X/EAP and RADIUS for wireless
- Use NAC, firewall rules and IDS/IPS signatures
- Enhance with web filtering, DNS filtering and email security
Topic 9A — Baselines
Secure baselines (CIS Benchmarks, vendor guides) define hardened configurations and are monitored for drift. Wireless: use WPA3 (SAE replaces PSK handshake), enterprise authentication with 802.1X and EAP through RADIUS, and site surveys and heat maps for placement. NAC checks device posture before granting access, using agents or agentless checks.
Topic 9B — Enhancement
Firewall rules are processed top-down with implicit deny at the end. IDS/IPS use signatures for known attacks and anomaly/behavior detection for unknown ones. Web filtering blocks categories and reputation; DNS filtering blocks malicious domains for every app. Email security: SPF lists permitted senders, DKIM signs messages, DMARC tells receivers what to do on failure. File integrity monitoring and DLP detect unwanted change or data loss.
Saved