Domain 2 — Architecture and Infrastructure Security

Week of 2026-10-06 · Download .docx

Objectives

Explain DMZ architecture, microsegmentation, and Zero Trust as layered network security controls.
Compare IDS, IPS, NGFW, honeypot, NAC, and CASB by function and placement.
Apply the cloud shared responsibility model across IaaS, PaaS, and SaaS service models.
Identify cloud security threats and controls including CSPM, DevSecOps, and container security.
Explain endpoint hardening, EDR, MDM, SNMPv3, patch management, and CIS Benchmarks.

Key terms

DMZ: Demilitarized Zone — network segment between two firewalls hosting public-facing services while protecting the internal LAN.
microsegmentation: Fine-grained internal security zones with individual access policies per workload — limits lateral movement.
east-west traffic: Server-to-server traffic within a data center — the target of lateral movement attacks.
Zero Trust: Architecture assuming no implicit trust; all access requires continuous authentication and authorization regardless of location.
NGFW: Next-Generation Firewall — adds application identification, IPS, and SSL/TLS decryption to stateful inspection.
IPS: Intrusion Prevention System — inline device that automatically blocks detected threats in real time.
honeypot: Decoy system designed to lure and monitor attacker behavior — provides high-fidelity threat intelligence.
NAC: Network Access Control — validates device compliance (patch level, antivirus) before granting network access.
CASB: Cloud Access Security Broker — enforces visibility and DLP policies between users and cloud services.
shared responsibility: Cloud security model dividing responsibility between the provider (infrastructure) and customer (data/config/app).
CSPM: Cloud Security Posture Management — tools that continuously scan cloud configurations for policy violations.
EDR: Endpoint Detection and Response — continuous behavioral monitoring with automated containment and rollback.
CIS Benchmarks: Prescriptive configuration hardening guides from the Center for Internet Security — industry-standard hardening reference.

The concept

NETWORK SECURITY ARCHITECTURE

Effective network security layers multiple controls so that defeating any one layer does not fully expose the system (defense in depth). The DMZ (Demilitarized Zone) places public-facing servers between two firewalls. An attacker who compromises a DMZ web server hits the second, internal firewall before reaching the corporate LAN. VLANs segment broadcast domains on a switch; microsegmentation extends this idea inside the data center, applying individual security policies per workload so that east-west lateral movement is controlled. Zero Trust Architecture removes the concept of implicit trust based on network location: every access request must be authenticated and authorized, every time, regardless of whether the requester is inside or outside the corporate network. This matters because attackers routinely achieve initial access and then move laterally — Zero Trust limits the blast radius.

FIREWALL, IPS, AND DETECTION TECHNOLOGIES

Firewalls evolved from stateless packet filters (port/IP only) to stateful (tracks connection state) to Next-Generation Firewalls (Layer 7 application identification, integrated IPS, SSL/TLS decryption). An IPS sits inline in the traffic path and drops malicious packets automatically; an IDS (Intrusion Detection System) is passive, receiving a traffic copy and generating alerts for human review. A honeypot is a decoy system — any interaction with it is inherently suspicious, giving defenders high-fidelity intelligence with low false-positive rates. NAC (Network Access Control) gates device access: before a device joins the network, NAC checks OS patch level, antivirus currency, and certificate validity — non-compliant devices go to a remediation VLAN. CASB enforces DLP and access policies as users access cloud services.

CLOUD SECURITY AND SHARED RESPONSIBILITY

In any cloud service model (IaaS, PaaS, SaaS), the customer is always responsible for data, IAM configuration, and application security. The provider secures physical hardware, the hypervisor, and the network fabric. In IaaS (like EC2 or Azure VMs), the customer also manages the OS, middleware, and application. In PaaS, the provider manages the runtime and OS. In SaaS, the provider manages almost everything except data and user access. The most common cause of cloud data breaches is misconfiguration — overly permissive IAM policies, publicly accessible storage buckets, and open security groups. CSPM tools scan continuously for these misconfigurations. DevSecOps integrates security into CI/CD pipelines ('shift left') — SAST scans code, DAST tests running applications, and container scanning checks images before deployment.

ENDPOINT HARDENING AND OPERATIONS

Endpoints are the most common attack entry point. A secure baseline configuration (from CIS Benchmarks) disables unnecessary services, removes default credentials, and establishes a known-good starting point. Full-disk encryption (BitLocker, FileVault, LUKS) protects data at rest from physical theft. EDR replaces traditional antivirus by using behavioral analysis — detecting fileless malware and zero-days that signatures miss, with automatic containment and rollback. MDM enforces security policies on mobile devices: screen lock, encryption, app allowlisting, remote wipe. SNMPv3 replaced v1/v2c by adding HMAC authentication and AES encryption for management traffic. Patch management closes the most common attack vector — known CVEs with public patches remain exploited for months after release.

Standards alignment: CompTIA Security+ SY0-701 Domain 2.1 (Architecture and Infrastructure Security); Maryland Blueprint College and Career Readiness — Technology and Engineering.

Worked examples

Example 1: A company's web server in the DMZ is compromised by an unpatched CMS vulnerability (CVSS 8.8). The attacker tries to pivot to the database server on the internal LAN, but the internal firewall only permits TCP 3306 from the application server IP — not from the web server IP. The attacker cannot reach the database. Post-incident, the team reviews CSPM findings and discovers three internal servers with security groups allowing 0.0.0.0/0 inbound on all ports — these are remediated immediately. Lesson: the DMZ limited blast radius; CSPM identified the adjacent risk.

Example 2: A school district deploys NAC. A student's laptop fails NAC posture check because it is running a 45-day-old OS build with a critical patch missing. The laptop is quarantined to a remediation VLAN with access only to the patch server. The OS patch installs automatically, NAC re-checks the device, and the laptop is moved to the student production VLAN — without any IT staff involvement. The same process catches a teacher's personal device (no district antivirus) and places it on a guest network instead, never allowing it into the internal domain.

Common mistakes

Placing internal servers (file servers, domain controllers) in the DMZ — the DMZ is only for public-facing services; internal servers belong on the protected LAN.
Confusing IDS (passive, alerts only) with IPS (inline, blocks automatically) — the 'P' in IPS stands for Prevention.
Assuming the cloud provider secures everything — in IaaS, the customer is responsible for OS updates, application security, and IAM configuration.
Treating CVSS score as the only remediation priority — a CVSS 7.0 being actively exploited in the wild may be more urgent than a CVSS 9.0 with no public exploit.
Assuming traditional antivirus catches fileless malware — fileless malware runs in memory, leaving no files for AV to scan; EDR behavioral analysis is required.

Self-check

Try each question before reading the answer. Answers at the bottom of this page.

1. The DMZ is positioned:

Inside the internal network
At the ISP's edge
Between two firewalls — external traffic reaches the DMZ but not the internal LAN
In the cloud only

2. In IaaS, the customer is responsible for:

Physical data center hardware
Hypervisor patching
OS, middleware, application, and data security
Network backbone uptime

3. EDR improves over traditional antivirus by:

Using a larger signature database
Continuous behavioral monitoring and automated response — detecting unknown threats by behavior
Scanning files only on access
Requiring cloud connectivity for all detections

4. A CASB provides:

On-premises firewall rules
Visibility and DLP enforcement between users and cloud services
VPN endpoint management
Server-side encryption

5. Zero Trust Architecture assumes:

Internal network users are implicitly trusted
A single firewall provides sufficient protection
No implicit trust — all access requires authentication and authorization regardless of network location
Encryption alone provides sufficient security

Self-check answers

1. C — The DMZ sits between an external firewall (internet-facing) and an internal firewall (LAN-facing). Public-facing servers live here.
2. C — In IaaS (EC2, Azure VMs), the customer manages the OS up through the application. The cloud provider handles physical hardware and the hypervisor.
3. B — EDR uses behavioral analysis to detect threats that have no known signature — including fileless malware and zero-days.
4. B — CASB sits between users and cloud services, enforcing DLP policies, blocking unauthorized uploads, and providing shadow IT visibility.
5. C — Zero Trust: 'never trust, always verify.' No request is trusted based on network location alone — every access requires continuous authentication and authorization.

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top