Objective 3.2: Apply security principles to secure enterprise infrastructure

Cert: CompTIA Security+ (SY0-701) Domain: 3.0 Security Architecture Weight: ~18% of SY0-701 (Domain 3 total) Depth: Apply. You should be able to take a small enterprise scenario, sketch the network with named security zones, place the right appliances in the right spots, pick the firewall family that fits the traffic problem, and pick the tunnel that fits the remote-access problem. Naming is not enough; you defend each choice.

What this objective tests

You should be able to name the five infrastructure considerations (device placement, security zones, attack surface, connectivity, failure mode), compare active versus passive devices and inline versus tap/monitor placement, name the network appliances on the SP-3.2 list (jump server, proxy server, IPS, IDS, load balancer, sensors), explain port security with 802.1X and EAP, compare WAF, UTM, NGFW, layer 4, and layer 7 firewalls, and pick between VPN, IPSec, TLS, SD-WAN, and SASE for a stated branch-office or remote-access problem. Every later Security+ objective in Domain 4 (security operations) assumes you can read this vocabulary without slowing down.

Key facts

The five infrastructure considerations

Before any appliance is bought, five choices have to be made. Get these right and the appliances do their job. Get them wrong and no amount of vendor magic recovers the design.

NIST SP 800-41 Rev 1 (Guidelines on Firewalls and Firewall Policy) treats the failure mode as a policy decision, not a vendor default. Write it down before the appliance ships.

Security zones

A zone is a named segment of the network with its own trust level. Boundaries are enforced by firewalls, VLAN ACLs, or both. Common zones in a small office:

• DMZ (Demilitarized Zone). Public-facing servers (web, email gateway, public DNS). Treated as semi-trusted; reachable from the internet but not allowed to reach the internal LAN freely.
• Internal. User workstations and on-prem servers. Trusted, but every request is still verified in a Zero Trust model.
• Guest. Visitor Wi-Fi or contractor jacks. Isolated from internal. Internet only.
• Management. Switches, firewalls, hypervisor consoles, out-of-band controllers. Locked down to admins, ideally reachable only from a jump server.
• OT (Operational Technology). Sensors, PLCs, building HVAC, manufacturing controllers. Strict allow-lists. Protocols like Modbus and BACnet often lack any built-in security.
• Server. On-prem application and database servers. Reachable from the user zones over only the application ports.

Zone boundaries are enforced by firewalls, VLAN ACLs (Access Control Lists), or SDN policy. Microsegmentation pushes the boundary down to individual workloads, which is the Zero Trust ideal.

Failure modes: fail-open vs fail-closed

When the security appliance dies, somebody has to decide what happens to the traffic.

• Fail-open. Traffic keeps flowing. Use when availability is the highest priority. A load balancer in front of a hospital portal is usually fail-open because losing patient access during an outage is worse than losing the protection layer briefly. The trade-off is that the protection disappears for the duration.
• Fail-closed. Traffic stops. Use when confidentiality or integrity wins. A firewall protecting a credit-card processor is usually fail-closed because letting unfiltered traffic through during an outage could leak cardholder data. The trade-off is that the outage takes the service with it.

NIST SP 800-41 Rev 1 calls this out explicitly: failure mode belongs in policy, not in the vendor default. The same appliance can be configured either way; policy decides.

Device attributes: active vs passive

Inline vs tap/monitor

• Inline. The device sits in the traffic path. Packets must pass through it. It can block. It adds some latency. Used for IPS, NGFW, WAF, and proxy servers.
• Tap or span port. The device sees a copy of the traffic. It can alert but cannot block. Used for IDS, traffic sensors, and NDR collectors.

A common SOC pattern is an inline IPS at the edge for blocking known attacks plus a sensor on a tap port deeper inside the network for full visibility without adding latency. Pair these with a SIEM (Security Information and Event Management) and you have prevention plus detection in one design.

Network appliances on SP-3.2

• Jump server (bastion host). A hardened gateway. Admins log into the jump server first, then reach internal systems from there. All admin traffic funnels through one auditable host, shrinking the admin attack surface and simplifying audit trails. Modern equivalents include Privileged Access Workstations (PAWs) and cloud-managed bastions like Azure Bastion or AWS Systems Manager Session Manager.
• Proxy server. A middleman that fetches traffic for clients. A forward proxy filters outbound user web traffic (common in school districts and large enterprises). A reverse proxy protects inbound traffic to a server (common in front of web apps). Both add filtering, caching, and detailed logging.
• IPS (Intrusion Prevention System). Inline. Blocks known attack signatures and policy violations in real time.
• IDS (Intrusion Detection System). Tap or span port. Alerts only. Cannot block. Useful where blocking would harm availability or where the goal is full visibility.
• Load balancer. Distributes incoming requests across multiple back-end servers so no single server is overwhelmed. Adds health checks, SSL termination, and (often) basic WAF functions.
• Sensors. Small data collectors that ship telemetry (flow records, packet captures, logs) to a SIEM or NDR (Network Detection and Response) platform. They are the eyes of the SOC.

Port security with 802.1X and EAP

802.1X is the port-level authentication protocol used on managed switches and wireless access points. The port stays closed (or sits in a guest VLAN) until the connecting device authenticates. EAP (Extensible Authentication Protocol) is the conversation format that 802.1X carries between the device, the authenticator (switch or AP), and the authentication server (often RADIUS).

Common EAP variants:

NAC (Network Access Control) products such as Cisco ISE, Aruba ClearPass, and FortiNAC sit on top of 802.1X and add posture checks (patched, EDR running, disk encryption on) before granting access.

Firewall family

Not every firewall does the same thing. Picking the right one for the traffic problem is half of SP-3.2.

NIST SP 800-41 Rev 1 covers placement and policy design for all of these. The selection rule is simple: pick the firewall that fits the traffic problem. SQL injection on a public web app means WAF. Twelve-user branch with one rack and one IT person means UTM. Enterprise edge with deep visibility means NGFW. Forty-Gbps data-center east-west at line rate means layer 4.

Secure communication: VPN, IPSec, TLS

A VPN (Virtual Private Network) is an encrypted tunnel between two endpoints over an untrusted network. Two flavors:

• Site-to-site VPN. Connects two networks. A branch joins headquarters as if it were on the same LAN. Usually built on IPSec.
• Remote-access VPN. Connects one user device to the corporate network. Usually built on TLS-based SSL VPN today, though IPSec remote-access VPNs still exist.

Remote-access patterns

• Full-tunnel VPN. All user traffic routes through corporate. Easy to monitor, heavier on bandwidth.
• Split-tunnel VPN. Only corporate traffic goes through the tunnel. Personal traffic goes direct. Lighter on bandwidth, harder to monitor.
• Always-on VPN. Tunnel connects automatically on boot. No user choice. Common on managed laptops.
• Clientless VPN. Browser-based access to a portal. No client install. Good for contractors and BYOD.
• ZTNA (Zero Trust Network Access). The Zero Trust replacement for traditional remote-access VPN. Per-app access, identity-verified, no broad network access. NIST SP 800-207 is the underlying standard.

SD-WAN

SD-WAN (Software-Defined WAN) lets software at each branch pick the best link for each app. Branch links can be MPLS, broadband, LTE, fiber, or satellite. Policy decides which app uses which link. Voice might ride MPLS for low jitter while bulk backup uses LTE only at night. The benefit is cheaper bandwidth and per-app routing flexibility. The gap: SD-WAN by itself is a routing decision. It does not add security.

SASE

SASE (Secure Access Service Edge) takes SD-WAN and adds cloud-delivered security in one stack. The bolted-on services usually include:

One vendor, one console, one policy across every branch and every remote user. The pattern is anchored in NIST SP 800-207 Zero Trust Architecture, which pushed the industry away from network-perimeter trust and toward identity-and-context trust. Choose SASE when consolidated cloud policy across many branches and many remote users is the goal. Choose a separate SD-WAN plus on-prem NGFW stack when you have heavy on-prem workloads, regulated traffic that cannot leave the data center, or an existing NGFW investment that still has years of life.

Selecting effective controls

SP-3.2 expects you to defend a choice, not just list options. Three questions before picking any control:

1. What threat does this stop in plain English? If you cannot say it without vendor language, you do not understand the control.
2. Where will it sit? Placement and failure mode. Inline or tap, fail-open or fail-closed.
3. How will I know it is working? Logs, alerts, dashboards. A control with no telemetry is theater.

CIS Controls v8 Control 12 (Network Infrastructure Management) and Control 13 (Network Monitoring and Defense) tie directly to this objective. They are the practical scoresheet behind the SP-3.2 vocabulary.

Common gotchas

• Calling an IDS an IPS. IDS alerts only. IPS blocks. The placement (tap versus inline) is the giveaway. If the answer choice says "span port" or "tap," it is an IDS.
• Treating UTM and NGFW as the same thing. UTM bundles many security functions in one box. NGFW is specifically an application-aware firewall with integrated IPS and user-identity awareness. A UTM may also be an NGFW, but the labels do not mean the same thing.
• Forgetting failure mode. The vendor default may be fail-open even when the policy needs fail-closed. NIST SP 800-41 Rev 1 says: write it into policy.
• Thinking the VPN is the security. The tunnel is encrypted. The endpoint still has to be patched, joined to AAA, and posture-checked. A compromised laptop on a VPN is a compromised laptop inside the network.
• Confusing SD-WAN with SASE. SD-WAN routes traffic. SASE routes traffic AND secures it. Picking one when you needed the other is a budget mistake that shows up in audit.
• Putting management interfaces on the user VLAN. Switch and firewall management belongs in its own zone, reachable only from a jump server. A printer with the default admin password on the user VLAN is a SOC ticket waiting to happen.
• Believing layer 4 firewalls can see SQL injection. They cannot. The payload is inside HTTP. Use a WAF or an NGFW with WAF features.
• Skipping the failure-mode conversation at the branch. A small office that loses internet during a fail-closed firewall outage may also lose the phone, the credit-card processor, and the alarm system. Make the trade-off explicit and document the mitigation.

Real-world context

A regional bank opens a new branch with 30 users. The CISO asks for an SP-3.2-style design. The SOC and the network team come back with:

• Zones. Internal (user workstations), management (switches and firewall), guest (visitor Wi-Fi), ATM (one VLAN with strict allow-list to the bank's ATM core).
• Edge appliance. NGFW with integrated IPS. Fail-closed because regulator policy says no unfiltered traffic ever. Both internet and the MPLS link to headquarters terminate here.
• Remote access. TLS-based SSL VPN for staff working from home (NIST SP 800-113). Always-on configuration. ZTNA in pilot for the wealth-management team to test per-app access.
• Site-to-site. IPSec tunnel from branch NGFW to the headquarters NGFW (NIST SP 800-77 Rev 1). Backup path uses LTE.
• Jump server. Branch IT can only reach the switch and firewall management interfaces from the central jump server, authenticated with MFA and EAP-TLS posture.
• Sensors. One tap on the internal VLAN feeding the SOC's NDR. The internal IDS alerts when an internal host talks to a known crypto-mining domain.

This is SP-3.2 vocabulary turned into a working drawing. Every Security+ student should be able to read the design, name each appliance, and defend each placement.

Sources

• CompTIA Security+ SY0-701 Exam Objectives, Objective 3.2.
• NIST SP 800-207 Zero Trust Architecture (2020).
• NIST SP 800-41 Rev 1 Guidelines on Firewalls and Firewall Policy (2009).
• NIST SP 800-77 Rev 1 Guide to IPSec VPNs (2020).
• NIST SP 800-113 Guide to SSL VPNs (2008).
• CIS Controls v8 Control 12 (Network Infrastructure Management).
• CIS Controls v8 Control 13 (Network Monitoring and Defense).
• IEEE 802.1X-2020 Port-Based Network Access Control.
• RFC 3748 Extensible Authentication Protocol (EAP).
• Gartner SASE definition (Andrew Lerner, 2019). Useful for industry framing; pair with NIST standards for the substance.