Network Security Controls
Deploy firewalls, segmentation, VPNs, IDS/IPS, and secure remote access as layered network defences.
- Certification
- CompTIA Security+
- Recommended study time
- 6h 35m
- Status
- Not started
Recommended study time
About 6h 35m in total, measured from the material on this page. At your session length of 45 minutes that is 9 sittings.
- Read the lesson23 min
About 2,945 words at a careful technical reading pace.
- Second pass with notes14 min
Re-read the harder parts and write your own notes.
- Recall from memory12 min
2 written recall questions.
- Practice decision12 min
One applied decision with feedback.
- Teach it back20 min
Write the topic in your own words.
- Real-world scenario15 min
Read the situation and justify your decision in writing.
- Hands-on practice3h 20m
Labs, commands and configuration until you can do it unaided.
- Spaced review1h 40m
4 short review sessions spread over the following weeks.
Learning objectives
- Write firewall rules that follow least privilege and are auditable.
- Design segmentation that limits lateral movement between zones.
- Compare VPN, zero-trust access, IDS, and IPS placement and purpose.
Start here
About 8 minutes of reading, in 10 short parts.
Network security controls are the actual devices and configurations that enforce security decisions on real traffic: firewalls, intrusion detection, VPNs, and network segmentation. Knowing what each control actually does, and does not do, prevents both under-protecting a network and wasting money on the wrong tool.
Where you meet it: A security engineer designs a network so that a compromised guest Wi-Fi device cannot reach the internal finance servers at all, because the two are segmented and the firewall between them denies that traffic by default.
The lesson, part by part
Open one part at a time. Each part stands on its own, so you can stop and come back.
A firewall is like a security guard at a door with a specific list of rules about who may enter and leave, checking every single person against that list rather than trusting anyone by default. An intrusion detection or prevention system is like a guard who also watches behaviour inside the building for suspicious activity, not just who is allowed through the door, since some threats look legitimate at the door but behave suspiciously once inside.
Network segmentation is like dividing a building into separate wings with locked doors between them, so that even if someone gets into one wing, they cannot freely wander into every other wing. A VPN is like a private, guarded tunnel connecting two buildings that are physically far apart, letting people move between them as if they were in the same building, without anyone outside being able to see or interfere with that journey.
Key ideas
If you remember nothing else from this topic, remember these.
- Firewalls filter traffic based on rules, ranging from simple packet filtering by port and address to stateful inspection that tracks connection context, up to next-generation firewalls that inspect application content.
- Intrusion detection systems passively alert on suspicious traffic, while intrusion prevention systems sit inline and can actively block traffic matching known attack patterns.
- Network segmentation, including VLANs, DMZs, and microsegmentation, limits how far an attacker can move laterally after gaining an initial foothold.
- A DMZ isolates internet-facing services like a public web server from the internal network, so a compromise of that server does not directly expose internal systems.
- VPNs create an encrypted tunnel across an untrusted network, commonly using IPsec or TLS, allowing remote users or sites to communicate as if on the same private network.
- Zero trust architecture assumes no implicit trust based on network location alone, requiring continuous verification of identity and device posture for every access request.
Designing layered controls for a newly exposed web application
A worked example, step by step.
A company is launching a new customer-facing web application that must connect to an internal database, and security needs to design the network controls before launch.
- 01Place the web server in a DMZDeploy the web application server in a DMZ segment, separate from both the internet and the internal network.
- 02Configure the outer firewallAllow only TCP 443 inbound from the internet to the DMZ web server, denying all other inbound traffic.
- 03Configure the inner firewallAllow only the specific database port needed, such as TCP 1433, from the DMZ web server to the internal database server, denying all other DMZ-to-internal traffic.
- 04Add an IPS inlineDeploy an intrusion prevention system between the internet and the DMZ to actively block known attack signatures such as SQL injection attempts before they reach the web server.
- 05Segment further with VLANsPlace the database server on its own internal VLAN separate from general office traffic, limiting lateral movement even if another internal system is compromised.
- 06Enforce remote administrative access via VPNRequire administrators to connect through an IPsec VPN before reaching any management interface, rather than exposing management ports directly to the internet.
- 07Apply zero trust verificationRequire device posture checks and strong authentication for any administrative session, regardless of whether the connection originates from inside or outside the office network.
- 08Validate the designRun a penetration test simulating a compromised web server and confirm the attacker cannot reach the database beyond the explicitly allowed port, nor pivot to other internal VLANs.
Outcome: Layered controls, DMZ placement, firewall rules scoped by exact port, inline IPS, VLAN segmentation, VPN-only administration, and zero trust verification, ensured that compromising the public-facing server alone would not lead to a full internal breach.
Network security control types
Worth keeping at hand while you work.
- Packet-filtering firewall
- Filters by source, destination, and port with no connection awareness
- Stateful firewall
- Tracks connection state, allowing return traffic for established sessions
- Next-generation firewall (NGFW)
- Adds application awareness, user identity, and deep packet inspection
- IDS
- Passively monitors and alerts on suspicious traffic, out of band
- IPS
- Actively blocks matching traffic in real time, deployed inline
- DMZ
- Isolated segment for internet-facing services, separated from internal network
- VLAN segmentation
- Separates broadcast domains to limit lateral movement
- IPsec VPN
- Encrypted tunnel commonly used for site-to-site connections
- SSL/TLS VPN
- Encrypted tunnel commonly used for remote client access via a browser or client app
- Zero trust architecture
- No implicit trust by network location, continuous verification required
- NAC (Network Access Control)
- Verifies device compliance and identity before granting network access
- Honeypot
- Decoy system deployed to attract and study attacker behaviour
Common misunderstandings
What most beginners get wrong here.
A firewall alone is sufficient to protect an internal network.
A firewall is one layer; defence in depth requires combining it with segmentation, IPS, endpoint controls, and identity verification, since any single control can fail or be bypassed.
IDS and IPS are the same thing with different names.
IDS passively monitors and only alerts, while IPS sits inline and can actively block matching traffic in real time.
Placing a server in a DMZ makes it fully secure from compromise.
A DMZ limits the blast radius if the server is compromised, but the server itself still needs hardening, patching, and its own access controls.
A VPN alone guarantees a remote connection is trustworthy.
A VPN only encrypts the connection; zero trust principles still require verifying the user's identity and the device's security posture before granting access.
Stateful firewalls understand application content the way next-generation firewalls do.
Stateful firewalls track connection state such as established sessions but do not inspect application-layer content the way an NGFW with deep packet inspection does.
Exam traps
How the question writers try to catch you out.
- Security+ frequently distinguishes IDS from IPS based on whether the device is inline (can block) or out of band (can only alert).
- Expect scenario questions where a DMZ is the correct answer for isolating a public-facing service from the internal network.
- Firewall type questions test recognition of packet-filtering versus stateful versus next-generation based on the described capability, such as tracking session state or inspecting application content.
- Zero trust questions often present a scenario where an internal user is still required to authenticate strongly, testing the 'never trust, always verify' principle regardless of location.
- VPN questions may ask you to choose between site-to-site (IPsec) and remote client access (SSL/TLS) based on the described use case.
Check yourself
Answer in your head first, then reveal. This is not scored.
What is the key functional difference between an IDS and an IPS?
Why is a DMZ used for internet-facing servers?
What capability distinguishes a next-generation firewall from a basic stateful firewall?
What does zero trust architecture assume about network location?
When would you choose a site-to-site IPsec VPN over an SSL/TLS VPN?
Why does VLAN segmentation help even if a firewall is already in place?
Quick reference
A condensed summary of the lesson above, for revision.
What It Is
Firewalls filter traffic by address, port, and increasingly by application and identity. Segmentation divides the network into zones with controlled paths between them. VPNs provide encrypted remote access, while zero-trust network access grants per-application access after verifying identity and device posture. IDS detects and alerts; IPS sits inline and can block.
Why It Matters
Ransomware spreads through permitted paths. Well-designed segmentation and default-deny filtering convert a catastrophic incident into a contained one, and provide the logs that make detection possible.
How It Works
- Stateful firewalls track sessions so return traffic is permitted without a separate rule.
- Segmentation enforces policy between VLANs, VRFs, or cloud security groups.
- IPS inspects traffic inline against signatures and behavioural rules and can drop matches.
Where You See It
- Internet edge, data centre segmentation, OT and guest isolation, remote access, and cloud security groups.
Key Terms
- Default deny
- Blocking all traffic except what is explicitly permitted.
- East-west traffic
- Traffic between internal systems rather than to the internet.
- DMZ
- A zone for internet-facing services isolated from internal networks.
- ZTNA
- Zero-trust network access granting per-application, verified access.
- Inline
- A device positioned so traffic must pass through it, enabling blocking.
Examples
- Blocking SMB between user workstations prevents a common ransomware spread path.
- Placing management interfaces in a restricted zone stops casual discovery from user VLANs.
Common Problems
- Overly broad any-any rules
- Undocumented legacy rules
- Flat internal networks
- Unmonitored IDS alerts
- Split tunnelling misconfiguration
How It Fails
- Permissive rules accumulate until the firewall no longer constrains anything meaningful.
- A flat network allows a single compromised host to reach every server.
- Alerting without ownership means detections are recorded and ignored.
How to Troubleshoot
- Read the rule that actually matched in the logs rather than the rule you expected.
- Test both directions and confirm stateful behaviour for the protocol involved.
- Verify inspection is enabled on the path in question, not just licensed.
Practical Knowledge
- Document every rule with owner, purpose, and review date.
- Start segmentation where impact is highest: backups, domain controllers, and management interfaces.
Exam Coverage
- Firewall types and rule design
- Segmentation and zoning
- VPN, ZTNA, IDS, and IPS
Interview Questions
- What is the difference between IDS and IPS in placement and effect?
- How would you begin segmenting a flat network with limited downtime?
Watch and read
Verified official and reputable sources for this topic. Links open in a new tab.
Video training
Lesson notes and bookmark
Notes and bookmarks for this lesson, saved with everything else you have marked.
No notes on this item yet.
Learning progress
0% across six evidence areas. Reading alone does not change progress.
Prerequisites
Next steps
- 01Review a firewall rule set for any-any rules and undocumented entries.
- 02Draw your network's zones and the permitted flows between them.