第 4 章，共 5 章14% 占考试比重

Network Security

Security protects the network's confidentiality, integrity, and availability. This chapter covers access control, common attacks and defenses, secure network design, and authentication. It stresses layered defenses and least-privilege principles that limit the impact of any single failure.

Access Control and Authentication

Access control determines who can use resources and to what extent. Authentication verifies identity, ideally with multiple factors, before granting access. Port-based control and central authentication servers enforce policy at the network edge.

Apply least privilege

Grant only the minimum access needed to limit damage from compromise.

Use role-based access control

RBAC assigns permissions by job function to simplify administration.

Enforce 802.1X at the edge

Port-based access control authenticates devices, often against RADIUS, before granting access.

Combine authentication factors

Mix something you know, have, and are for stronger multifactor authentication.

Common Attacks and Defenses

Attackers exploit weaknesses at every layer, from ARP poisoning to phishing. Recognizing attack patterns enables the right countermeasures. Switch features and user awareness reduce exposure significantly.

Mitigate MAC flooding with port security

Limiting MACs per port stops attackers from overflowing the CAM table.

Defend against ARP poisoning

Dynamic ARP Inspection and DHCP snooping prevent on-path interception.

Train users against phishing

Awareness reduces successful credential theft from deceptive emails.

Secure Network Design

Design choices shape a network's security posture before any attack occurs. Segmentation, isolation zones, and firewalls contain threats and limit lateral movement. A default-deny stance underlies sound firewall policy.

Isolate public services in a DMZ

A screened subnet protects the internal LAN if a public server is compromised.

Enforce default-deny firewall rules

Block all traffic not explicitly permitted to follow least privilege.

Segment with VLANs

Separating traffic limits broadcast scope and contains breaches.

Secure Remote Access and Trust

Remote access and evolving trust models extend security beyond the perimeter. VPNs encrypt traffic across untrusted networks, and zero trust verifies every request. These approaches address a workforce that is increasingly distributed.

Encrypt remote access with VPNs

IPsec or SSL/TLS tunnels protect confidentiality and integrity in transit.

Adopt zero trust principles

Verify every request continuously regardless of network location.

Use secure management protocols

Prefer SSH and SNMPv3 over clear-text Telnet and older SNMP versions.

测试你的知识

练习 Network Security 的相关题目

立即练习 →

← 上一章

Network Operations

Network Troubleshooting

Last updated: July 2026