11 Managing Security Architecture to Protect Infrastructure · Security+

Exam objective 3.2: Given a scenario, manage the security architecture to best protect the infrastructure.

Chapter 10 compared architecture models. This chapter is about operating inside whichever model you chose: where to place security devices, how to divide the network into security zones, how to shrink the attack surface, and how to apply diversity. It then covers Zero Trust architecture (user authentication, device health and inventory, and application access control); the technologies for secure communication and access, including VPNs, remote access, tunneling, user management and least privilege, end-to-end encrypted messaging, out-of-band management, file transfer, and Security Service Edge (SSE); identity management topics such as group Managed Service Accounts (gMSAs), least privilege access accounts, and privilege creep; and the failure modes of security devices.

"Given a scenario" means you will be asked to apply these ideas. Expect a network diagram or a short story—a company adding remote workers, an administrator who cannot reach a crashed switch, a service account whose password never changes—and a question asking which design, protocol, or control best solves the problem. Performance-based questions frequently ask you to place devices on a diagram or choose firewall and VPN settings, so practice reasoning about where a control belongs, not just what it is.

Infrastructure Considerations

Security Zones

A security zone is a portion of the network in which systems share a common trust level and security requirements. Traffic between zones passes through an enforcement point—usually a firewall—where policy is applied. Zones are the practical implementation of the segmentation concepts from Chapter 10. Common zones include:

Untrusted (external): the internet and any network the organization does not control.
Screened subnet (DMZ): a zone between the internet and the internal network that hosts public-facing services such as web servers, mail relays, and reverse proxies. If a DMZ server is compromised, the attacker is still separated from internal systems by another firewall boundary.
Internal (trusted): user workstations and general business servers.
Restricted or high-security: databases holding sensitive data, payment systems, domain controllers.
Management: the network used to administer infrastructure devices, isolated from user traffic.
Guest and IoT: networks for visitors and untrusted devices, allowed internet access but nothing internal.
OT/ICS: industrial control systems, isolated from IT as described in Chapter 10.

The guiding rule is that traffic from a less trusted zone to a more trusted zone should be denied by default and allowed only for specific, documented needs. For example, the internet may reach the web server in the screened subnet on TCP 443, and the web server may reach one database server on its database port, but the internet should never reach the database directly.

Rule Source Destination Port/Proto Action
1 Any DMZ-Web 443/TCP Allow
2 DMZ-Web Internal-DB01 1433/TCP Allow
3 Mgmt-Jump DMZ-Web 22/TCP Allow
4 Any Any Any Deny (implicit)

Figure 11.1: Security zones separated by firewalls, with only specific documented flows allowed between them

Exam tip

When a scenario asks where to put a server that must be reachable from the internet, the answer is almost always the screened subnet (DMZ). When it asks where to place a database that only the web tier uses, the answer is an internal or restricted zone reachable only from the web tier.

Device Placement

Device placement is the decision about where in the network each security device sits. A device can only inspect and control traffic that passes through or near it, so placement determines effectiveness. Device Typical placement Why

Perimeter firewall /

Ngfw

Between the internet and the organization

Enforces policy on all inbound and outbound traffic

Internal firewall Between internal zones Controls east-west traffic and limits lateral movement

Web application firewall (WAF)

Directly in front of web servers or as a cloud service

Inspects HTTP for injection, XSS, and other application attacks

Reverse proxy / load balancer

In the screened subnet, in front of web servers

Hides back-end servers, terminates TLS, distributes load

Forward proxy / secure web gateway

Between users and the internet Filters and logs outbound web traffic

IPS Inline, behind the perimeter firewall Blocks malicious traffic that passes firewall rules IDS sensor Out of band on a TAP or SPAN (mirror) port

Monitors copies of traffic without affecting the flow

Jump server (bastion host)

In the management zone or DMZ Single controlled entry point for administration VPN concentrator At the perimeter, often in the DMZ Terminates remote-access and site-to-site tunnels Sensors and collectors

Near the systems they monitor Feed logs and flows to the SIEM

Two device attributes affect placement decisions:

Inline (active) devices sit directly in the traffic path and can block traffic—firewalls, IPS, WAF, proxies. They add latency and become a point of failure (see Failure Modes below).
Passive (monitoring) devices receive a copy of traffic from a network TAP or a switch SPAN/port mirror and can only alert. They cannot disrupt traffic, but they cannot block attacks either.

Real-world scenario

A university places its new IDS sensor on a SPAN port of the core switch so that it sees traffic between student housing and the data center without adding latency. Months later, the security team wants to automatically block exploitation attempts against the student information system. A passive sensor cannot block, so the team deploys an IPS inline between the core switch and the data center firewall and configures it to fail open (discussed later) to protect availability during exam registration.

Attack Surface

The attack surface is the sum of all points where an attacker could try to enter or extract data: open ports, exposed services, APIs, user accounts, remote access gateways, physical ports, wireless networks, third-party connections, and people. Chapter 7 covers attack surfaces from the attacker's view; here the task is to manage it architecturally.

Ways to reduce the attack surface:

Disable unused services, ports, and protocols, and remove stale accounts and excess privileges.
Expose only what must be public, through the screened subnet, reverse proxies, or ZTNA; consolidate administration through jump servers and out-of-band management.
Replace insecure protocols (Telnet, FTP, SNMPv1/v2c) with secure ones (SSH, SFTP, SNMPv3).
Inventory external-facing assets continuously, since every new cloud resource changes the surface.

Security devices are part of the attack surface too: internet-facing VPN concentrators and firewalls are prime targets, so keep them patched and limit their management exposure.

Diversity

Diversity means using different vendors, technologies, or control types so that one vulnerability or failure cannot defeat every layer. You met diversity in Chapter 1 as part of defense in depth; architecturally it takes several forms:

Vendor diversity: perimeter firewall from one vendor, internal firewall from another.
Technology diversity: combining signature-based and behavior-based detection, or network and host controls.
Control diversity: pairing technical, physical, and administrative controls.
Path and provider diversity: two internet service providers using physically separate routes. Diversity costs expertise, licensing, and integration effort, so use it where a single flaw would be catastrophic.

Zero Trust Architecture

Chapter 1 introduced the principles of Zero Trust—never trust, always verify; least privilege; assume breach—and its control plane (policy engine and policy administrator) and data plane (policy enforcement point). Objective 3.2 asks you to apply Zero Trust through three building blocks: user authentication, device management, and application access control.

User Authentication

In a Zero Trust architecture, identity is the primary perimeter. Every request is tied to an authenticated user (or workload), and that authentication must be strong and continuously evaluated.

Strong, phishing-resistant MFA such as FIDO2/WebAuthn security keys or passkeys, rather than SMS codes that can be intercepted or approved through push-fatigue attacks.
Centralized identity provider (IdP) with single sign-on so that policy is evaluated in one place and access can be revoked everywhere at once.
Adaptive (risk-based) authentication that raises requirements when context changes—a new country, an impossible-travel pattern, an unusual time, or a sensitive resource.
Continuous evaluation: sessions are re-checked when risk signals change, rather than trusted for their entire lifetime.

Device Management: Health and Inventory

A legitimate user on a compromised device is still a threat. Zero Trust therefore evaluates the device as well as the user.

Inventory: the organization must know which devices exist and which are managed. Unknown or unmanaged devices receive no access or limited access. Inventory comes from mobile device management (MDM) and unified endpoint management (UEM) platforms, asset databases (Chapter 15), and device certificates that prove a device is corporate-issued.
Health (posture): before granting access, the policy engine checks signals such as OS version and patch level, disk encryption status, EDR agent running and reporting no active threats, firewall enabled, screen lock configured, and the device not jailbroken or rooted.

Posture is evaluated at connection time and re-evaluated during the session. If the EDR agent reports malware, access can be revoked automatically.

Application Access Control

Zero Trust grants access to specific applications, not to networks. Instead of a VPN that places a user on the internal network with broad reach, Zero Trust Network Access (ZTNA) brokers a connection from the authenticated user and healthy device to one authorized application, and nothing else. Applications are often invisible to unauthorized users altogether ("dark" to the internet), so they cannot be scanned or attacked.

Application access control is enforced through:

Per-application policies combining user role, group, device posture, location, and time.
Microsegmentation so that workloads can communicate only with the specific services they need.
Least privilege within the application, using role-based or attribute-based authorization.
Session monitoring and revocation.

Zero Trust building block

Question it answers Example signals and tools

User authentication Is this really the user? IdP, SSO, phishing-resistant MFA, risk-based sign-in Device health Is the device secure right now? EDR status, patch level, encryption, jailbreak detection

Device inventory Is this a known, managed device? MDM/UEM enrollment, device certificates, asset database

Application access control

Should this user on this device reach this application?

ZTNA, per-app policy, microsegmentation

Real-world scenario

A healthcare provider replaces its VPN for clinical staff with ZTNA. A nurse on a hospital-issued, encrypted, fully patched tablet can open the electronic health record application after signing in with a FIDO2 key. The same nurse on a personal laptop is granted only the web-based scheduling portal, and attempts to reach the records system are blocked. When the tablet's EDR agent detects suspicious activity, the policy engine revokes its sessions within seconds. Access depends on user, device, and application—not on being "inside" the network.

Common trap

A VPN is not Zero Trust by itself. A traditional VPN authenticates a user once and then grants network-level access, which is exactly the implicit trust Zero Trust removes. If a question asks how to give remote users access to one specific internal application while verifying device health, ZTNA is the better answer. Secure Communication and Access

Virtual Private Networks (VPN)

A virtual private network creates an encrypted tunnel across an untrusted network, typically the internet, so that traffic is protected from eavesdropping and tampering. VPNs come in two main forms:

Site-to-site VPNs connect entire networks—a branch office to headquarters, or an on-premises data center to a cloud virtual network. They are configured between gateways (routers or firewalls) and are invisible to end users.
Remote-access (client-to-site) VPNs connect individual users' devices to the organization's network, using a client application or the operating system's built-in client.

The main VPN technologies are:
Technolog
y
Layer and ports Key characteristics

IPsec Network layer; IKE on UDP 500, NAT traversal on UDP 4500; ESP

is IP protocol 50, AH is IP protocol 51

Standard for site-to-site; ESP provides confidentiality, integrity, and authentication; AH provides integrity and authentication only

TLS (SSL)

Vpn

Uses TCP 443 Works through most firewalls; can be clientless (browser-based portal) or client-based

L2TP/IPsec UDP 1701 inside IPsec L2TP provides tunneling, IPsec provides encryption; largely legacy WireGuard UDP (commonly 51820) Modern, lightweight, small codebase, fixed modern cryptography IPsec operates in two modes:

Transport mode encrypts only the payload of each IP packet, leaving the original IP header in place. It is used for host-to-host communication.
Tunnel mode encrypts the entire original packet and wraps it in a new IP header. It is used for site-to-site and most remote-access VPNs because it hides internal addresses.

Figure 11.2: IPsec transport mode encrypts only the payload, while tunnel mode encrypts the entire original packet behind a new IP header

Remote-access VPNs also differ in how much traffic goes through the tunnel:

Full tunnel: all of the client's traffic, including internet browsing, is sent through the VPN to the corporate network, where it can be inspected and filtered. More secure and more visible, but it consumes corporate bandwidth and adds latency.
Split tunnel: only traffic destined for corporate resources uses the VPN; internet traffic goes directly from the user's location. Better performance, but the organization cannot inspect that internet traffic, and a compromised client could act as a bridge between the internet and the corporate network.

Figure 11.3: A full tunnel sends all traffic through corporate inspection, while a split tunnel sends internet traffic directly

Exam tip

If a scenario requires that all remote user traffic be inspected by corporate security controls, choose a full tunnel. If it emphasizes reducing bandwidth on the corporate link for cloud and internet traffic, choose split tunnel—and recognize the visibility trade-off. If it requires encrypting traffic between two offices, choose a site-to-site IPsec VPN in tunnel mode.

Remote Access

Remote access covers all methods administrators and users employ to reach systems from elsewhere. Common methods and their security considerations:

Remote Desktop Protocol (RDP) on TCP 3389 provides graphical access to Windows systems. RDP exposed directly to the internet is one of the most common ransomware entry points. Require Network Level Authentication (NLA), MFA, and access only through a VPN, ZTNA, or an RD Gateway.
Secure Shell (SSH) on TCP 22 provides encrypted command-line access. Use key-based authentication, disable direct root login, and restrict which accounts and source addresses may connect.
Jump servers (bastion hosts) are hardened systems that administrators connect to first, and from which they reach the target systems. They centralize logging, MFA, and session recording, and they mean target systems need to accept administrative connections from only one source.
Virtual desktop infrastructure (VDI) keeps data in the data center; the remote device receives only screen images.
Privileged access management (PAM) tools broker and record administrative sessions and inject credentials administrators never see.

Tunneling

Tunneling encapsulates one protocol inside another so that traffic can cross a network that would otherwise not carry it, or so that it can be protected in transit. VPNs are tunnels, but tunneling is broader:

IPsec and TLS tunnels encrypt traffic between endpoints.
GRE (Generic Routing Encapsulation) carries one network protocol inside IP but provides no encryption on its own, so it is often combined with IPsec.
SSH tunneling (port forwarding) carries arbitrary TCP traffic inside an encrypted SSH session— useful for administrators, and a favorite technique for attackers bypassing firewall rules. ssh -L 8443:intranet-app.corp.local:443 admin@bastion.corp.example

The command above forwards the administrator's local port 8443 through the bastion host to an internal web application, encrypted inside SSH.

Tunneling cuts both ways. Attackers use DNS tunneling, HTTPS tunneling, and SSH tunnels to exfiltrate data or maintain command and control through channels the firewall allows. Defenders counter with TLS inspection, DNS monitoring for unusually long or frequent queries, and egress filtering that permits only approved protocols to approved destinations.

User Management and User Access (Least Privilege)

User management is the life cycle of accounts that use secure access: creating, adjusting, and promptly disabling them (Chapter 18 covers provisioning). For remote access, it means deciding who is eligible for VPN or ZTNA at all, enrolling MFA, and integrating gateways with the central directory so that disabling one account removes all access.

User access should follow least privilege: each user receives only the access needed for the job. In remote-access terms, this means:

Granting VPN or ZTNA access by group or role, with each group reaching only the applications and subnets it needs.
Restricting administrative protocols (RDP, SSH) to administrators, through jump servers only.
Time-limiting access for contractors and vendors and requiring approval for each vendor session.
Reviewing remote-access entitlements regularly.

End-to-End Encrypted Messaging

End-to-end encryption (E2EE) means messages are encrypted on the sender's device and can be decrypted only on the recipients' devices. The service provider relays the ciphertext but never holds the keys, so it cannot read the content—and neither can an attacker who compromises the provider's servers. The Signal Protocol, used by Signal and WhatsApp, is the best-known example; it uses asymmetric key exchange and frequently changing session keys to provide forward secrecy. E2EE contrasts with encryption in transit (such as TLS between your device and the server), where messages are decrypted on the server and could be read by the provider or by anyone who compromises it.

Security implications for organizations:

Strong confidentiality for sensitive communication, such as executive or incident-response discussions, especially when the normal channel may itself be compromised.
Reduced visibility. DLP, content inspection, and eDiscovery cannot read E2EE content in transit. Organizations subject to record-keeping rules (financial services, government) must use approved platforms that support archiving, or retain records at the endpoint.
Endpoint security matters most. Because content is readable only on endpoints, a compromised phone exposes everything.
Key verification. Users should verify safety numbers or security codes to detect on-path attacks.

Note

During a major incident, the attacker may be reading corporate email and chat. Incident response plans often specify an out-of-band, end-to-end encrypted communication channel for the response team so that the adversary cannot monitor the response.

Out-of-Band Management

Out-of-band (OOB) management provides administrative access to network and server infrastructure through a dedicated path that is separate from the production (in-band) network. If a misconfiguration, outage, or attack takes down the production network, administrators can still reach devices through the OOB path.

Common OOB methods include:

A separate management network with its own switches, connected to device management ports.
Console servers connected to the serial console ports of routers, switches, and firewalls.
Baseboard management controllers (BMCs) such as IPMI, Dell iDRAC, and HPE iLO, which allow power control and console access to servers even when the operating system is down.
Cellular or dial-up modems for remote sites, as a last-resort path.

Because OOB interfaces provide powerful, low-level control—often below the operating system—they are high-value targets. Secure them by isolating the management network from user and internet traffic, requiring MFA and strong unique credentials, changing default passwords on BMCs, patching BMC firmware, and logging all access.

Real-world scenario

An engineer pushes an access control list to the core router that accidentally blocks all management traffic, including the SSH session used to make the change. Because the organization maintains a console server on a separate management network with a cellular backup link, the engineer connects to the router's serial console out of band and removes the faulty ACL within minutes, without anyone driving to the data center.

File Transfer

Moving files between organizations, systems, and users is routine and frequently exploited. The exam expects you to choose secure protocols.

Protocol Port(s) Security

FTP TCP 20/21 Insecure: credentials and data in cleartext

TFTP UDP 69 Insecure: no authentication; used for device boot images and configs on trusted networks only

SFTP TCP 22 Secure: runs over SSH; encrypts commands, credentials, and data SCP TCP 22 Secure: SSH-based file copy

FTPS TCP 990 (implicit) or 21 (explicit, with AUTH TLS)

Secure: FTP with TLS encryption

HTTPS TCP 443 Secure: web-based uploads and downloads with TLS

Memory aid

SFTP uses SSH; FTPS uses SSL/TLS—the S moves to the end when TLS is "added on" to FTP. SFTP is not FTP at all; it is an SSH subsystem on port 22.

Organizations often use managed file transfer (MFT) platforms that add centralized policy, encryption at rest, integrity checking, audit logging, and DLP scanning. Because MFT platforms are internet-facing and hold sensitive data, they have been exploited in several large data theft campaigns; patch them aggressively and monitor them closely. Hash files to verify integrity and scan uploads for malware. Security Service Edge (SSE)

Security Service Edge (SSE) is a cloud-delivered set of security services that protect users' access to the web, cloud services, and private applications, wherever the users are. Instead of backhauling remote traffic to a corporate data center for inspection, users connect to the nearest SSE point of presence, which applies consistent policy.

SSE typically combines:

Secure web gateway (SWG): filters web traffic, blocks malicious and prohibited sites, and inspects downloads.
Cloud access security broker (CASB): provides visibility and control over SaaS applications— discovering shadow IT, enforcing policies on uploads and sharing, and detecting risky activity.
Zero Trust Network Access (ZTNA): brokers per-application access to private applications, replacing or supplementing VPNs.
Firewall as a service (FWaaS) and DLP: cloud-delivered network filtering and data protection, often included.

Secure Access Service Edge (SASE) combines SSE with networking capabilities, chiefly SD-WAN, into a single converged service. A useful way to remember the relationship: SASE = SSE + SD-WAN. SSE is the security half of SASE.

Exam tip

When a scenario describes a distributed workforce, heavy SaaS use, and a desire to apply consistent web filtering, SaaS controls, and private-app access from the cloud without routing traffic through headquarters, the answer is SSE (or SASE if networking/SD-WAN is also part of the requirement).

Identity Management

Group Managed Service Accounts (gMSAs)

Service accounts run applications, scheduled tasks, and services. Traditionally they were ordinary domain user accounts with passwords that administrators set once and never changed—because changing the password meant updating it on every server that used it. These static, often over-privileged, and widely known passwords are a favorite target for attackers (for example, through Kerberoasting, which cracks service account passwords offline).

A group Managed Service Account (gMSA) is an Active Directory account type designed to solve this problem:

Automatic password management. Active Directory generates a long, complex random password (240 bytes) and rotates it automatically, every 30 days by default. No human ever knows or types the password.
Multiple hosts. Unlike the older standalone managed service account (sMSA), which is tied to one computer, a gMSA can be used by a defined group of servers—for example, all nodes in a web farm or cluster.
Controlled retrieval. Only computers explicitly authorized (through the PrincipalsAllowedToRetrieveManagedPassword attribute) can obtain the current password from domain controllers.
No interactive logon. gMSAs are intended for services, not people, reducing misuse. gMSAs require a Key Distribution Services (KDS) root key in the domain.

Add-KdsRootKey -EffectiveImmediately

New-ADServiceAccount -Name gmsaWebApp -DNSHostName gmsaWebApp.corp.example.com ` -PrincipalsAllowedToRetrieveManagedPassword "WebFarmServers"

Install-ADServiceAccount -Identity gmsaWebApp

Exam tip

If a scenario describes service accounts with passwords that never change, passwords shared across many servers, or Kerberoasting risk, and the environment is Active Directory, the best answer is to convert them to gMSAs. Remember the key benefit: automatic password rotation without manual intervention.

Least Privilege Access Accounts

Least privilege access accounts apply the principle of least privilege to the way accounts are structured:

Separate standard and privileged accounts. Administrators use a standard account for email and browsing, and a separate administrative account only for administrative tasks. Malware triggered by a phishing email then runs without administrative rights.
Tiered administration. Administrative accounts are scoped by tier—for example, accounts that manage domain controllers cannot log on to workstations, preventing credential theft from lower-tier systems from exposing the highest tier.
Just-in-time (JIT) and just-enough administration (JEA). Privileges are granted for a limited time and scope when needed and removed automatically afterward, leaving no standing privileged access.
Privileged access management (PAM). Credentials are vaulted, checked out with approval, rotated after use, and sessions are recorded.
Scoped service accounts. Service accounts and cloud workload identities receive only the specific rights the service needs, never Domain Admin or global administrator.

Privilege Creep

Privilege creep is the gradual accumulation of permissions beyond what a person's current role requires, usually because new access is granted when someone changes jobs or joins a project, but old access is never removed. Over years, a long-tenured employee may hold access to systems across several departments—a violation of least privilege that increases insider risk and the damage an attacker can do with that account.

Privilege creep is countered by:

Periodic access reviews (recertification), in which managers or data owners confirm that each user still needs each entitlement.
Role-based access control, so that changing a user's role swaps their permission set rather than adding to it.
Mover processes in the identity life cycle that remove old access when people change roles.
Automated identity governance tools that flag unused or anomalous entitlements.
Time-bound access that expires unless renewed.

Common trap

Do not confuse privilege creep with privilege escalation. Privilege creep is a slow, administrative failure in which legitimate access accumulates. Privilege escalation is an attack in which someone exploits a flaw to gain rights they were never granted.

Failure Modes

Security devices fail—through power loss, hardware fault, software crash, or overload. The failure mode determines what happens to traffic or access when they do. Designers must choose deliberately, because the right answer depends on whether availability or confidentiality and integrity matter more for the protected system.

Fail-open: when the device fails, traffic passes through without inspection or access is permitted. Availability is preserved, but security is lost during the failure. An inline IPS with a bypass module that lets traffic flow if the IPS crashes is fail-open.
Fail-closed: when the device fails, all traffic is blocked or access is denied. Security is preserved, but availability is lost. A firewall that stops forwarding when its rule engine crashes is fail-closed. Physical security uses related terms that are easy to mix up:
Fail-safe prioritizes the safety of people: an electronic door lock that unlocks during a power failure or fire so occupants can escape.
Fail-secure prioritizes the security of assets: a lock that remains locked during a power failure, such as on a data center cage or vault.

Failure mode

What happens on failure Prioritizes Typical use

Fail-open Traffic or access allowed Availability IPS protecting a business-critical link; emergency exits (fail-safe)

Fail-closed Traffic or access denied Confidentiality and integrity

Perimeter firewall; access to restricted data; vault doors

(fail-secure)

Failure modes apply beyond network devices: a DLP system that cannot inspect a file must either block or allow the transfer. Redundancy—high-availability pairs, redundant power—reduces how often a failure-mode decision matters at all (Chapter 13).

Real-world scenario

A stock trading firm deploys an inline IPS on the link carrying orders to the exchange. Every second of outage costs significant revenue, so the IPS is configured to fail open with a hardware bypass, and a second IPS in a high-availability pair minimizes how often bypass happens. The same firm configures the firewall protecting its customer account database to fail closed: a brief outage is acceptable, but unfiltered access to customer data is not.

Exam tip

Read the scenario's priority. If it stresses that the business cannot tolerate downtime, choose fail-open. If it stresses that unauthorized access must never occur, choose fail-closed. For doors, life safety (fail-safe) always wins where people may be trapped.

Chapter Summary

Security zones group systems by trust level; traffic between zones passes through enforcement points, with less-trusted-to-more-trusted traffic denied by default. Public services belong in the screened subnet (DMZ).
Device placement determines what a control can see and stop. Inline devices (firewall, IPS, WAF) can block; passive devices (IDS on a TAP or SPAN) can only alert.
Reduce the attack surface by disabling unused services, limiting exposure, and replacing insecure protocols. Use diversity of vendors and technologies where a single flaw would be catastrophic.
Zero Trust architecture evaluates user authentication, device health and inventory, and per-application access for every request. ZTNA grants access to applications, not networks.
VPNs may be site-to-site or remote access, IPsec (tunnel or transport mode), TLS, or WireGuard, and full or split tunnel.
Secure remote access with jump servers, MFA, PAM, and no direct internet exposure of RDP or SSH. Tunneling protects traffic but can also be abused for exfiltration.
E2EE messaging keeps content unreadable by the provider but limits DLP and eDiscovery visibility.
Out-of-band management provides a separate administrative path that works when production fails; it must be strongly protected.
Use SFTP, SCP, FTPS, or HTTPS for file transfer; avoid FTP and TFTP across untrusted networks.
SSE combines SWG, CASB, ZTNA, and often FWaaS and DLP from the cloud; SASE = SSE + SD-WAN.
gMSAs provide automatic password rotation for service accounts across multiple hosts. Least privilege access accounts separate standard and privileged use and apply JIT and PAM. Privilege creep is countered by access reviews and role-based access.
Fail-open preserves availability; fail-closed preserves security. Fail-safe protects people; fail-secure protects assets.

Key Terms

Security zone; screened subnet (DMZ); management network; device placement; inline device; passive device; network TAP; SPAN port; jump server (bastion host); attack surface; diversity; Zero Trust architecture; identity provider; phishing-resistant MFA; adaptive authentication; device posture; device inventory; MDM/UEM; Zero Trust Network Access (ZTNA); application access control; VPN; site-to-site VPN; remote-access VPN; IPsec; IKE; ESP; AH; transport mode; tunnel mode; TLS VPN; WireGuard; full tunnel; split tunnel; RDP; SSH; VDI; privileged access management (PAM); tunneling; GRE; SSH port forwarding; DNS tunneling; user management; least privilege; end-to-end encryption; forward secrecy; out-of-band management; console server; baseboard management controller (BMC); SFTP; FTPS; SCP; managed file transfer (MFT); Security Service Edge (SSE); secure web gateway (SWG); CASB; FWaaS; SASE; SD-WAN; group Managed Service Account (gMSA); KDS root key; Kerberoasting; least privilege access accounts; tiered administration; just-in-time access; privilege creep; access review; failure mode; fail-open; fail-closed; fail-safe; fail-secure.

Review Questions

1. A company is deploying a public-facing web server that must query an internal database. Where should the web server be placed?

A. On the internal user network, with port forwarding from the internet
B. In the screened subnet, with a firewall rule allowing it to reach only the database port
C. On the same VLAN as the database server
D. In the management network

2. A security engineer wants to monitor traffic between two core switches for signs of attack without introducing latency or any risk of blocking legitimate traffic. Which approach BEST meets this requirement?

A. Install an IPS inline between the switches
B. Connect an IDS sensor to a network TAP on the link
C. Deploy a WAF in front of the switches
D. Configure the core switches to fail closed

3. A company wants remote employees to reach only a specific internal HR application, and only from company-managed devices with current patches and an active EDR agent. Which solution BEST meets these requirements?

A. A full-tunnel IPsec remote-access VPN
B. Zero Trust Network Access with device posture checks
C. Port forwarding the HR application to the internet
D. A site-to-site VPN to each employee's home

4. The security team requires that all internet traffic from remote employees be inspected by the company's web filtering and DLP controls. Users currently connect through a VPN. Which configuration should be used?

A. Split tunnel
B. Full tunnel
C. IPsec transport mode
D. GRE without encryption

5. An administrator misconfigures a firewall and loses all SSH connectivity to it from the production network. Which capability would have allowed the administrator to recover remotely?

A. End-to-end encrypted messaging
B. Out-of-band management through a console server on a separate network
C. A split-tunnel VPN
D. A secure web gateway

6. A partner organization needs to send daily files containing customer records. The current process uses FTP over the internet. Which replacements provide encryption of credentials and data? (Select TWO.)

A. TFTP
B. SFTP
C. Telnet
D. FTPS
E. HTTP

7. An Active Directory audit finds that the service account running a web application on six servers has had the same password for seven years and has been targeted by Kerberoasting attempts. What is the BEST remediation?

A. Add the service account to Domain Admins so it can rotate its own password
B. Convert the service account to a group Managed Service Account
C. Document the password in a shared spreadsheet so it can be changed later
D. Disable Kerberos for the domain

8. During an access review, a manager discovers that an analyst who moved from accounts payable to marketing two years ago still has approval rights in the payment system. Which problem does this represent?

A. Privilege escalation
B. Privilege creep
C. Split tunneling
D. Shadow IT

9. A trading company places an inline IPS on the link to its order-processing system. Management states that the order link must stay up even if the IPS hardware fails. How should the IPS be configured?

A. Fail-closed
B. Fail-open
C. Fail-secure
D. Passive mode on a SPAN port only

10. A company with a largely remote workforce and extensive SaaS use wants cloud-delivered web filtering, SaaS visibility and control, and private-application access without routing traffic through headquarters. Which solution BEST fits?

A. Security Service Edge (SSE)
B. A larger on-premises proxy server
C. An air-gapped network
D. A site-to-site IPsec VPN

11. An executive team plans to discuss an ongoing breach in which the attacker may have access to corporate email. Which communication method BEST protects the confidentiality of the discussion?

A. Corporate email with TLS between mail servers
B. An end-to-end encrypted messaging application on separate, trusted devices
C. The corporate chat platform
D. SMS text messages

12. An organization wants to reduce the risk that malware from a phishing email gains administrative control of servers. Which practices BEST support this goal? (Select TWO.)

A. Administrators use separate standard and privileged accounts
B. All IT staff are made permanent members of Domain Admins for convenience
C. Privileged access is granted just in time and removed automatically
D. RDP is exposed directly to the internet for faster remote support
E. Service accounts are given interactive logon rights

Answers and Explanations

1. B. Public-facing servers belong in the screened subnet (DMZ), with a firewall permitting only the specific traffic needed to reach the database. Placing the server on the internal network or the database VLAN would expose internal systems if the web server were compromised, and the management network is reserved for administration.
2. B. An IDS connected to a TAP receives a copy of the traffic and cannot add latency or block anything. An inline IPS sits in the traffic path and can both add latency and block traffic. A WAF protects web applications, not switch links, and fail-closed describes behavior on failure, not monitoring.
3. B. ZTNA grants access to a specific application based on user identity and device posture, matching both requirements. A traditional VPN grants broader network access and does not inherently check device health. Port forwarding exposes the application to the internet, and a site-to-site VPN connects networks rather than individual users.
4. B. A full tunnel sends all client traffic, including internet browsing, through the corporate network where it can be inspected. Split tunneling sends internet traffic directly, bypassing corporate controls. Transport mode and GRE do not address which traffic is routed through the tunnel, and unencrypted GRE is insecure.
5. B. Out-of-band management provides a separate path—such as a console server on an isolated management network—that works when the production path fails. E2EE messaging, split tunneling, and a secure web gateway do not provide device management access.
6. B, D. SFTP (over SSH on port 22) and FTPS (FTP with TLS) both encrypt credentials and data. TFTP has no authentication or encryption, Telnet is a cleartext remote shell rather than a file transfer protocol, and HTTP is unencrypted.
7. B. A gMSA lets Active Directory generate and automatically rotate a long, random password that multiple authorized servers can retrieve, eliminating static passwords and making Kerberoasting impractical. Adding the account to Domain Admins violates least privilege, a shared spreadsheet exposes the password, and disabling Kerberos would break authentication across the domain.
8. B. Retaining access from a previous role is privilege creep, the gradual accumulation of permissions. Privilege escalation is an attack that exploits a flaw to gain unauthorized rights. Split tunneling is a VPN configuration, and shadow IT is unapproved technology use.
9. B. Fail-open allows traffic to pass if the IPS fails, preserving availability as management requires. Fail-closed (and fail-secure, its physical security counterpart) would block the link. Passive mode would avoid the outage risk but would also eliminate the IPS's ability to block attacks, which is why it was placed inline.
10. A. SSE delivers SWG, CASB, and ZTNA from the cloud, applying consistent policy to remote users without backhauling traffic. A larger on-premises proxy still requires backhauling, an air gap would prevent SaaS use, and a site-to-site VPN connects networks rather than providing these services.
11. B. End-to-end encryption on trusted devices ensures that only the participants can read messages, even if corporate systems are compromised, and keeps the discussion out of band from the attacker. TLS between mail servers protects only transit; messages are readable on the compromised servers. Corporate chat may also be compromised, and SMS is not encrypted end to end.
12. A, C. Separate standard and privileged accounts ensure that malware launched from a user's everyday account lacks administrative rights, and just-in-time access removes standing privileges an attacker could steal. Permanent Domain Admin membership, internet-exposed RDP, and interactive logon for service accounts all expand privileges and the attack surface.