Network Security – CompTIA Security+ Study Guide
Overview
Network security forms a core domain of the CompTIA Security+ certification, covering how organizations protect infrastructure, data, and services from unauthorized access and attacks. This guide covers firewalls, network architecture, secure protocols, VPNs, wireless security, and common attack countermeasures. Mastering these concepts requires understanding not just definitions, but the why behind each control and how technologies interact.
---
Firewalls & Network Devices
Summary
Firewalls are the primary gatekeepers of network traffic. Security+ tests your ability to distinguish between firewall types, understand their limitations, and know which device is appropriate for a given scenario.
Firewall Types
| Type | OSI Layer | Key Capability |
|------|-----------|----------------|
| Stateless (Packet Filtering) | Layer 3–4 | Evaluates each packet independently by IP/port rules |
| Stateful | Layer 3–4 | Tracks active connection state/session context |
| Next-Generation Firewall (NGFW) | Layer 7 | Deep packet inspection, app awareness, IPS integration |
| Web Application Firewall (WAF) | Layer 7 | Filters HTTP/HTTPS; targets OWASP Top 10 threats |
Intrusion Detection vs. Prevention
Other Network Security Devices
Key Terms
Watch Out For
> ⚠️ Exam Trap: IDS alerts — it does not block. If a question asks which device "detects but does not prevent," the answer is IDS, not IPS.
>
> ⚠️ WAF vs. NGFW: A WAF specifically protects web applications (HTTP/HTTPS). An NGFW is broader but may not provide the same depth of web application inspection as a dedicated WAF.
>
> ⚠️ NIPS vs. HIPS: Location matters. Network-based = segment-level protection. Host-based = single endpoint protection.
---
Network Segmentation & Architecture
Summary
Proper network architecture limits the blast radius of a breach. Security+ heavily tests segmentation concepts, zero trust principles, and the purpose of isolation techniques.
Key Architectural Concepts
Traffic Flow Concepts
Network Access Control (NAC)
NAC enforces endpoint compliance before granting network access:
Key Terms
Watch Out For
> ⚠️ Zero Trust ≠ No VPN: Zero Trust is an architecture philosophy, not a single product. It can coexist with VPNs, though cloud-based ZTNA solutions may replace them.
>
> ⚠️ VLANs are Layer 2: VLAN segmentation does not provide Layer 3 routing control by itself — you need ACLs or a firewall at Layer 3 to control inter-VLAN traffic.
>
> ⚠️ Air Gap is physical, not logical: An air-gapped system cannot be reached remotely; threats must be introduced physically (e.g., USB drive).
---
Secure Protocols & Services
Summary
Knowing which protocols are secure versus insecure, and on which ports they operate, is essential for Security+ exam success. Focus on the protocol pairs (secure vs. insecure equivalents).
Protocol Comparison Table
| Insecure Protocol | Secure Replacement | Port (Insecure) | Port (Secure) | Protection |
|---|---|---|---|---|
| HTTP | HTTPS | 80 | 443 | TLS encryption |
| Telnet | SSH | 23 | 22 | Full session encryption |
| FTP | SFTP or FTPS | 21 | 22 (SFTP) / 990 (FTPS) | Encrypted transfer |
| SNMP v1/v2c | SNMPv3 | 161 | 161 | Auth + encryption |
| DNS | DNSSEC | 53 | 53 | Cryptographic record signing |
| LDAP | LDAPS | 389 | 636 | TLS-encrypted directory queries |
TLS (Transport Layer Security)
Key Protocol Details
Key Terms
Watch Out For
> ⚠️ SFTP ≠ FTPS: SFTP runs over SSH (port 22). FTPS is FTP with TLS (port 990/21). They are completely different protocols — the exam will try to confuse you.
>
> ⚠️ DNSSEC signs records but doesn't encrypt queries: It prevents tampering with DNS responses, but DNS queries are still visible. DNS over HTTPS (DoH) provides privacy.
>
> ⚠️ TLS ≠ SSL: SSL is deprecated and broken. Always refer to TLS as the current standard. Never recommend SSL on the exam.
---
VPN & Remote Access
Summary
VPNs create encrypted tunnels for secure remote communication. Security+ tests your knowledge of VPN types, tunneling protocols, and the security trade-offs of each approach.
VPN Types
| Type | Use Case | Key Characteristic |
|------|----------|--------------------|
| Site-to-Site VPN | Permanent tunnel between offices/networks | Always-on, gateway-to-gateway |
| Remote-Access VPN | Individual users connecting from anywhere | User-initiated, client software required |
| Always-On VPN | Corporate devices outside trusted network | Auto-connects when off-network; no user action needed |
Tunneling Trade-offs: Full vs. Split Tunnel
- ✅ Maximum visibility and control for the organization
- ❌ Higher bandwidth consumption; can slow user experience
- ✅ Better performance; reduces VPN bandwidth load
- ❌ Internet traffic is unmonitored; potential security gap
VPN Protocols & Ports
- UDP port 500 – IKE (Internet Key Exchange) for key negotiation
- UDP port 4500 – NAT traversal (IKE NAT-T)
- Commonly paired with L2TP (L2TP/IPsec) for remote access
Key Terms
Watch Out For
> ⚠️ Split tunneling is a security risk: An exam scenario about unmonitored internet traffic or a user bypassing corporate controls points toward split tunneling as the problem.
>
> ⚠️ L2TP alone is NOT secure: L2TP provides tunneling but no encryption. It must be paired with IPsec (L2TP/IPsec) for security.
>
> ⚠️ Always-on VPN benefits: Questions about ensuring consistent security policy enforcement for mobile/remote workers point to always-on VPN as the answer.
---
Wireless Security
Summary
Wireless security requires understanding the evolution of Wi-Fi security protocols and recognizing common wireless attacks. Security+ expects you to rank protocols by security strength and understand specific attack mechanisms.
Wireless Security Protocol Evolution
| Protocol | Security | Key Weakness |
|----------|----------|--------------|
| WEP | ❌ Broken | Short 24-bit IVs repeat; static keys; crackable in minutes |
| WPA (TKIP) | ⚠️ Weak | Improved on WEP but still uses RC4; deprecated |
| WPA2 (AES/CCMP) | ✅ Good | PSK vulnerable to offline dictionary attacks |
| WPA3 (SAE) | ✅✅ Strong | Forward secrecy; resistant to offline dictionary attacks |
WPA2-Personal vs. WPA2-Enterprise
| Feature | WPA2-Personal | WPA2-Enterprise |
|---------|---------------|-----------------|
| Authentication | Pre-Shared Key (PSK) | 802.1X + RADIUS server |
| Per-user credentials | ❌ No | ✅ Yes |
| Accountability | Limited | Full (individual user tracking) |
| Best for | Home/small office | Corporate environments |
WPA3 – SAE (Simultaneous Authentication of Equals)
Common Wireless Attacks
Key Terms
Watch Out For
> ⚠️ WEP is always wrong: Any exam scenario asking for a secure wireless recommendation — WEP is never the answer. If it appears in a scenario, it's the problem to fix.
>
> ⚠️ Evil Twin ≠ Rogue AP: A rogue AP is any unauthorized AP. An Evil Twin specifically mimics a legitimate SSID to deceive users — the distinction matters for scenario questions.
>
> ⚠️ Deauth attacks enable handshake capture: The goal isn't just disconnection — it forces a reconnection event that exposes the 4-way handshake for offline cracking.
---
Network Attacks & Countermeasures
Summary
Security+ tests both attack recognition and appropriate countermeasure selection. For every attack, know the mechanism, the protocol or technology exploited, and the specific defense.
Attack & Countermeasure Pairs
| Attack | Mechanism | Countermeasure |
|--------|-----------|----------------|
| ARP Spoofing/Poisoning | Forged ARP replies link attacker MAC to legitimate IP; enables MITM | Dynamic ARP Inspection (DAI) |
| DNS Spoofing/Cache Poisoning | Injects false DNS records to redirect traffic | DNSSEC, DNS sinkhole |
| Rogue DHCP Server | Attacker's DHCP server assigns malicious gateway/DNS | DHCP Snooping |
| DDoS Amplification | Small spoofed requests generate large responses overwhelming victim | Rate limiting, BCP38 filtering, upstream scrubbing |
| MITM (Man-in-the-Middle) | Attacker intercepts communication between two parties | Encryption (TLS), certificate pinning, DAI |
Defense Technologies
#### DNS Sinkhole
#### Dynamic ARP Inspection (DAI)
#### DHCP Snooping
#### Honeypot