3.2 - Securing enterprise infrastructure
Security+ SY0-701 objective 3.2 covers principles for securing enterprise network infrastructure. Egress filtering restricts which outside destinations internal hosts may connect out to, limiting data exfiltration and malware callbacks, whereas ingress filtering controls what comes in. Microsegmentation allows traffic based on workload identity or labels rather than broad subnets, so a compromised host cannot roam freely. Placing public-facing servers in a separate subnet isolated from the internal LAN creates a screened subnet, also called a DMZ. A next-generation firewall decides allow or deny based on the actual application in the traffic. You should also consider device placement, failure modes (fail-open versus fail-closed), and secure communication like VPNs. Expect scenario questions that describe a segmentation, filtering or placement need and ask which infrastructure control best applies.
Restrict where internal hosts connect OUT = egress filtering. Allow by workload identity/labels = microsegmentation. Public servers isolated from LAN = screened subnet (DMZ). Allow/deny by application = NGFW.
Practice questions
1. Placing public-facing servers in a separate subnet isolated from the internal LAN creates a:
- A decoy honeypot host
- Screened subnet (DMZ) (correct answer)
- An encrypted VPN tunnel
- A redundant RAID array
A screened subnet (DMZ) hosts internet-facing services between two firewalls, so a compromise there doesn't directly expose the internal network.
2. An inline security appliance is configured so that if it fails, traffic is BLOCKED rather than passed. This posture is:
- Fail-open (fail-safe pass)
- Fail-soft mode
- Fail-closed (fail-secure) (correct answer)
- Load-shedding
Fail-closed/fail-secure blocks traffic on failure, favoring security over availability. Fail-open passes traffic on failure, favoring availability — choose per risk and criticality.
3. A firewall rule set that permits specific traffic and denies everything else follows which principle?
- Implicit allow
- Implicit deny (correct answer)
- Open by default
- Trust all internal
Implicit deny (deny-by-default) blocks anything not explicitly permitted — a secure default for firewalls and ACLs. Only allow what's needed.
4. Splitting a flat network into isolated zones to limit lateral movement is called:
- Port forwarding
- Network segmentation (correct answer)
- Load balancing
- Bandwidth throttling
Segmentation (VLANs, subnets, microsegmentation) isolates systems so a breach in one zone can't freely spread laterally. It enforces least access between segments.
5. A company wants a web application shielded from injection and XSS attacks at the application layer. Deploy a:
- A basic packet-filter firewall
- A web application firewall (WAF) (correct answer)
- A DHCP relay agent
- A network load balancer
A WAF inspects HTTP/S at layer 7 to block SQLi, XSS and other web attacks. A packet-filter firewall works at layers 3/4 and can't understand application content.
6. To stop unauthorized laptops from getting a live connection when plugged into a wall jack, enable:
- An isolated guest Wi-Fi network
- Switch port security / 802.1X (correct answer)
- A wider DHCP address scope
- A public-facing DMZ subnet
Port security limits which MAC addresses a switch port allows, and 802.1X requires authentication before the port grants network access — stopping rogue devices at the jack.