Domain 4 – Section A Review: Network Architecture and Security

This section integrates:

• Secure Network Architecture Design — segmentation, micro-segmentation, SDN, NAT, converged protocols, wireless, NAC
• Secure Network Component Implementation — firewalls, IDS/IPS, switch and router hardening, load balancers, endpoint security, DNS security, proxies
• Secure Communication Channel Implementation — IPSec, SSL/TLS VPN, remote access, VoIP, email security, API security, ZTNA

Domain 4 questions require you to match threats to the correct layer, select the right component or protocol for a specific scenario, and understand why architecture decisions create or eliminate attack surfaces. The right technology at the wrong layer is just as wrong as no technology at all.

1. Architecture Defines the Battlefield

Every breach outcome is shaped by the network architecture that existed before the attacker arrived. Segmentation determines lateral movement. DMZ design determines whether a compromised public server can reach internal systems. Micro-segmentation determines whether east-west traffic is controlled.

When a scenario describes an attacker moving freely after initial compromise, ask:

• Where were the boundaries?
• What control points existed between zones?
• Was east-west traffic inspected or just north-south?

2. Components Must Match the Threat Layer

A WAF solves application-layer problems. A stateful firewall solves transport and network-layer problems. DHCP snooping solves Layer 2 problems. Selecting the right component starts with identifying what layer the attack operates at.

• Application-layer attacks → WAF, application-layer proxy
• Network/transport attacks → stateful firewall, NIPS
• Data link attacks (ARP, VLAN hopping) → switch security features
• Unknown/zero-day attacks → anomaly-based IPS, EDR

3. Channels Protect Data in Motion

Every communication channel needs protection matched to its requirements. Site-to-site connections need IPSec. Remote access needs VPN or ZTNA with MFA. Email needs both content protection (S/MIME/PGP) and sender authentication (SPF/DKIM/DMARC). Voice needs SRTP.

The exam tests whether you can distinguish between:

• Authentication vs. encryption (DMARC vs. S/MIME)
• Integrity vs. confidentiality (AH vs. ESP)
• Network access vs. application access (VPN vs. ZTNA)

Section A Decision Pattern

When facing a Domain 4 Section A question:

1. Identify the threat layer — is this a network, transport, or application problem?
2. Match the component to the layer — the right control operates at or near the threat layer
3. Check for architecture gaps — would segmentation, micro-segmentation, or DMZ design have prevented the scenario?
4. Verify the channel — is data in transit protected with the right protocol for confidentiality, integrity, and authentication?
5. Eliminate distractors — NAT is not security, VLANs are not physical separation, AH is not encryption, DMARC is not encryption

Section A – Practice Questions

Question 1

A manufacturing company’s SCADA systems and corporate workstations share the same flat network. An employee opens a malicious email attachment on their workstation, and the resulting malware scans the network and discovers the SCADA controllers. The malware begins sending commands to the controllers.

What architectural failure enabled this attack?

A. No network segmentation between IT and OT (operational technology) environments, allowing direct communication from a compromised workstation to SCADA systems
B. The email security gateway failed to detect the malicious attachment
C. The employee was not trained to recognize phishing emails
D. The SCADA systems were not running antivirus software

Question 2

A security team deploys a network-based intrusion detection system at the perimeter. After a month, the team discovers that attackers have been exfiltrating data through encrypted HTTPS connections that the NIDS cannot inspect.

What is the MOST effective solution to this visibility gap?

A. Replace the NIDS with a web application firewall
B. Block all HTTPS traffic at the perimeter
C. Deploy SSL/TLS inspection capabilities that decrypt, inspect, and re-encrypt HTTPS traffic before it passes the NIDS
D. Switch from signature-based detection to anomaly-based detection

Question 3

An organization is connecting to a new cloud service provider. The connection will carry customer financial data. The security team is evaluating whether to use MPLS or an IPSec VPN over the internet.

The CISO requires that the data be encrypted in transit. Which option meets this requirement?

A. MPLS alone, since it provides dedicated circuits that are inherently encrypted
B. IPSec VPN over the internet, since IPSec provides encryption, integrity, and authentication for all traffic in the tunnel
C. Either option, since both MPLS and IPSec encrypt data by default
D. Neither option provides encryption; a separate TLS layer must be added

Question 4

A hospital network includes medical IoT devices (infusion pumps, patient monitors) on the same VLAN as clinician workstations. A network assessment reveals that the IoT devices run outdated firmware with known vulnerabilities and cannot be patched by the manufacturer for six months.

What is the BEST immediate action to reduce risk?

A. Disconnect all IoT devices until patches are available
B. Install host-based firewalls on each IoT device
C. Implement micro-segmentation to isolate IoT devices from workstations and restrict IoT communication to only required clinical systems
D. Deploy antivirus software on the IoT devices

Question 5

An organization’s DNS resolver has been compromised through cache poisoning. Users are being redirected to fraudulent banking sites that steal credentials. The security team wants to prevent this type of attack in the future.

What technology should be deployed?

A. A web application firewall to inspect DNS traffic
B. Network address translation to hide the DNS resolver from external attackers
C. DNS over HTTPS (DoH) to encrypt all DNS queries
D. DNSSEC to validate the authenticity and integrity of DNS responses through digital signatures

Question 6

A company’s VoIP system runs on the same network infrastructure as regular data traffic. The security team has discovered that an attacker used ARP spoofing to position themselves as a man-in-the-middle and recorded executive phone calls for two weeks.

Which combination of controls would have prevented BOTH the interception and the eavesdropping?

A. NAT for voice traffic and WPA3 for wireless voice devices
B. A next-generation firewall at the perimeter and port mirroring for voice traffic monitoring
C. VLAN segmentation for voice traffic and antivirus on workstations
D. Dynamic ARP Inspection to prevent ARP spoofing and SRTP to encrypt voice media streams

Question 7

A retail company processes credit card transactions through web-based POS terminals. A penetration test reveals that the terminals are accessible from the guest Wi-Fi network because both networks share the same subnet.

What is the FIRST architectural change needed?

A. Deploy a WAF in front of the POS terminals
B. Implement WPA3 on the guest Wi-Fi network
C. Segment the POS network onto a dedicated VLAN with firewall rules that block all traffic from the guest network
D. Enable MAC address filtering on the guest network

Question 8

An organization uses a traditional IPSec VPN for remote access. After connecting, remote employees have full access to the entire internal network. The security team has documented several incidents where compromised remote laptops were used to scan and attack internal servers.

What architectural change BEST addresses this problem?

A. Implement Zero-Trust Network Access to provide application-specific access with continuous device posture verification
B. Add a network-based IDS behind the VPN concentrator
C. Replace the IPSec VPN with an SSL/TLS VPN using split tunneling
D. Require stronger passwords for VPN authentication

Question 9

A security analyst observes that an attacker is using double-tagging to hop from VLAN 10 (user workstations) to VLAN 20 (database servers) by exploiting the native VLAN configuration on a trunk port.

Which switch configuration change would prevent this VLAN hopping attack?

A. Configure a dedicated unused VLAN as the native VLAN on all trunk ports and ensure all access ports are explicitly assigned to their respective VLANs
B. Enable spanning tree protocol on all ports
C. Deploy a network tap on the trunk port to monitor traffic
D. Increase the VLAN numbering to use higher numbers

Question 10

A company’s email domain is being spoofed in phishing campaigns targeting the company’s own customers. The attackers send emails that appear to come from the company’s billing department. The company has published SPF records but has not implemented DKIM or DMARC.

Why is SPF alone insufficient to stop this spoofing?

A. SPF encrypts email content, but the attackers are bypassing the encryption
B. SPF only validates the envelope sender (MAIL FROM), not the header From address that users see, and without DMARC there is no policy telling receivers to reject failures
C. SPF requires all recipients to have certificates installed
D. SPF only works for internal email, not external email