CAS-005 exam objective 3.2 asks you to design secure network architectures using segmentation, micro-segmentation, VPNs, and network access controls. If you have never worked in IT, this can sound like a swamp of buzzwords. In plain terms, this concept solves one brutal problem: how do you keep attackers from hopping from one computer to another once they get inside a network? Every company that stores customer data, processes payments, or connects remote workers depends on getting this right.
Jump to a section
A simple way to picture Network Security Architecture and Segmentation
Have you ever lived in or visited a large apartment building where security actually worked, and you felt safe? How did that building keep residents, guests, and delivery drivers separate while still letting everyone do their jobs?
That building is a perfect picture of network security architecture. The front door is your first firewall. But you wouldn't let a pizza delivery driver wander around looking for apartment 3B, right? So the building has a locked lobby door (a perimeter firewall), then an internal door for each apartment (internal segmentation). Inside your own apartment, you might keep your bedroom door locked and your laptop in a desk drawer — that is micro-segmentation.
The building manager issues different keys and passes. Residents get a master key to the building and their own flat. Maintenance staff get keys only to utility closets, not your bedroom. This is exactly what network access controls (NAC) do: authenticate, authorise, and restrict.
Now, what if a resident works from home and needs secure access to their office network? They use a VPN — think of it as a secure, private tunnel from their apartment building all the way into their office, encrypted so nobody on the street can peek at the documents they are carrying.
Finally, segmenting guests from residents — putting visitors on a separate Wi-Fi that cannot reach your smart TV or home files — is exactly how you segment corporate networks. You keep the payment system (PCI zone) far away from the guest Wi-Fi, because you wouldn't let a random stranger sleep in your bedroom on the way to the kitchen.
Network security architecture is the blueprint of how you organise all the computers, servers, printers, and other devices in an organisation to prevent an attacker from roaming freely. Think of it like zoning laws in a city: you do not put a factory next to a school without walls and locks between them.
The core tool is segmentation. Segmentation means dividing a network into smaller, isolated sections called subnets (short for sub-networks) or VLANs (Virtual Local Area Networks). A VLAN is a way to split a physical network into multiple virtual networks so that traffic from one VLAN cannot talk to another VLAN unless you specifically allow it. For example, a company might put all its employee laptops in VLAN 10, all its printers in VLAN 20, and all its servers in VLAN 30. A laptop in VLAN 10 cannot directly reach the server in VLAN 30 unless the security rules say it is allowed. This stops a virus on a laptop from jumping straight to the server that holds customer credit cards.
Micro-segmentation takes this further. Instead of separating whole groups of devices, you isolate individual workloads. A workload is a single application or service running on a server. With micro-segmentation, the web server that displays your company's website cannot talk to the database server at all — except on a specific port (a numbered doorway used for a specific type of traffic) and only for the exact data it needs. This is like giving each person in an office building their own locked room that only the receptionist can open, rather than just locking the floor.
Why do we need this? Historically, networks were flat. A flat network is one where every device can talk to every other device, like a single room where everyone can hear everyone else's conversations. Attackers loved flat networks because once they compromised one laptop, they could move sideways — a technique called lateral movement — to find valuable data anywhere in the network. The 2013 Target breach was a classic case: attackers got in through a heating and cooling contractor's network, then moved laterally to the point-of-sale system handling credit cards. Segmentation would have blocked that path.
VPNs (Virtual Private Networks) extend this security to remote connections. When an employee works from a coffee shop, their data travels over the public internet, which is like mailing a postcard. Anyone along the route can read it. A VPN encrypts (scrambles) the data and encapsulates it inside a secure tunnel so that only the intended network can decrypt it. This is essential for remote workers, branch offices, and cloud connectivity.
Network Access Control (NAC) is the security guard at the door. NAC checks every device that tries to connect to the network — laptops, phones, even smart coffee machines. It verifies that the device has up-to-date antivirus software, a current operating system, and proper authentication credentials. If a device fails the check, NAC can quarantine it by placing it in a restricted VLAN where it can only reach a remediation server to get fixed. This prevents infected devices from spreading malware.
Putting it all together: you segment the network to restrict lateral movement, micro-segment critical applications to isolate them completely, use VPNs to secure remote connections, and deploy NAC to enforce the rules at every entry point. These layers work together so that even if an attacker breaks through one barrier, they face another immediately.
Map the network and classify assets
Identify every device, server, and application on the network. Classify them by sensitivity: public-facing, internal, financial data, personal data. This step determines where segmentation boundaries need to be drawn.
Define segmentation zones (VLANs and subnets)
Create separate VLANs for different categories, for example employee workstations, printers, servers, and guest Wi-Fi. Each VLAN corresponds to a different subnet with a dedicated IP range. This physically separates traffic at Layer 2.
Configure firewall rules between zones
Install a firewall (hardware or virtual) between VLANs and define access control lists (ACLs) that specify what traffic is allowed between zones. Use the principle of least privilege: allow only the minimum necessary communication. For example, allow print servers to talk to printers but block workstations from directly accessing the database server.
Implement micro-segmentation for critical workloads
For the most sensitive applications (like payment databases), use host-based firewalls or software-defined networking to create rules that restrict traffic at the individual workload level. For example, a web server should only communicate with the application server on a specific port and only for HTTP requests.
Deploy Network Access Control (NAC)
Set up NAC software that checks device compliance (patch level, antivirus, authorised software) before granting access. Configure a quarantine VLAN for non-compliant devices. This ensures only healthy devices enter the segmented zones.
Set up VPNs for remote access
Choose a VPN protocol (IPsec or SSL/TLS) and configure a VPN concentrator at the network perimeter. Distribute VPN client software to remote users. Enforce that all remote traffic goes through the VPN (disable split-tunnelling) so the company can inspect traffic for threats.
Monitor and audit segmentation rules regularly
Use logging and monitoring tools to review firewall logs, NAC reports, and VPN connection logs. Periodically audit the rules to remove any that are too permissive. Attackers probe for misconfigurations, so continuous review is essential.
Consider a mid-sized e-commerce company called 'ShopVault Limited' that sells furniture online. ShopVault has 200 employees, a website hosted on Amazon Web Services (AWS), a customer database with payment card information, and 20 remote sales staff who travel to trade shows. Their IT security manager, Priya, needs to protect customer data and comply with the Payment Card Industry Data Security Standard (PCI DSS).
Step one: Priya maps the network. She segments the internal office network into several VLANs:
VLAN 10: employee workstations (laptops and desktops)
VLAN 20: printers and scanners
VLAN 30: servers for internal applications (HR, email)
VLAN 40: guest Wi-Fi for visitors
VLAN 50: the payment systems that process credit cards (this is the PCI zone)
She configures a firewall between each VLAN using a stateful firewall, which tracks the state of active connections and only allows return traffic that matches a valid outbound request. For example, traffic from VLAN 40 (guest Wi-Fi) is blocked from reaching any internal VLAN entirely.
Step two: micro-segmentation. Inside the AWS cloud, she creates separate virtual private clouds (VPCs) — isolated virtual networks — for the web server, the application server, and the database server. She writes security group rules (the AWS equivalent of a firewall) that say:
The web server can only talk to the application server on port 443 (HTTPS) and only for HTTP requests.
The application server can only talk to the database server on port 3306 (MySQL) and only from the application server's private IP address.
The database server cannot initiate any outbound connections to the internet.
This ensures that even if an attacker exploits a vulnerability in the web server, they cannot reach the database containing customer credit cards.
Step three: VPNs for remote workers. Priya sets up an IPsec VPN for the 20 sales staff. Each remote employee installs a VPN client on their laptop. When they connect from a hotel Wi-Fi, the client creates an encrypted tunnel to a VPN concentrator at ShopVault's office. All traffic between the laptop and the office is encrypted. Priya also configures split-tunnelling to be disabled, meaning all the remote worker's internet traffic goes through the VPN, so ShopVault can inspect it for malware.
Step four: Network Access Control. Priya deploys a NAC solution that checks each device before granting access. When an employee's laptop connects to the office network, the NAC scans it to ensure - the antivirus is running and up-to-date - the operating system is patched to the latest version - the device is not running any prohibited software (like illegal file-sharing tools)
If a laptop fails the check, the NAC places it in a quarantine VLAN — VLAN 99 — where the device can only reach a patch server to update its software. Once the laptop is clean, NAC moves it to the appropriate work VLAN.
The result: customers trust ShopVault with their payment details, the company passes PCI audits, and remote workers stay productive without endangering the network.
CAS-005 exam objective 3.2 is not theoretical. It tests your ability to design and choose the right controls. The exam loves scenario-based multiple-choice questions where you must pick the segmentation technique that prevents lateral movement in a given situation.
Here is what you must master:
Segmentation vs. Micro-segmentation: You will get a question like, 'An organisation wants to isolate its web server from the database server on the same physical host. Which technique should they use?' The answer is micro-segmentation, not VLAN segmentation, because VLANs operate at the network level and cannot isolate two virtual machines on the same hypervisor. Micro-segmentation uses software-defined networking (SDN) or host-based firewalls to control traffic between individual workloads.
VPN types: The exam tests the difference between site-to-site VPNs (connecting two entire networks, like an office and a branch) and remote-access VPNs (connecting a single user). You must know that IPsec and SSL/TLS are the two common protocols. IPsec is often used for site-to-site, SSL/TLS for client-to-site.
Network Access Control (NAC): Questions will present a scenario where a contractor's laptop is infected. The correct answer is to use pre-admission NAC that scans the device before granting access. Post-admission NAC (scanning after connection) is a trap — it is less secure because the infected device is already inside.
Zero Trust: The exam frames segmentation and micro-segmentation as core components of a Zero Trust architecture (never trust, always verify). You will see 'Zero Trust' in the answer options. Understand that Zero Trust means no device is trusted by default, even if it is inside the office.
Common traps: - 'Flat network' is always the wrong answer for any security question. If an option says 'keep the network flat for simplicity', reject it. - 'Allowing all traffic between VLANs' defeats segmentation. The correct answer always involves restricting traffic to only what is necessary (least privilege). - Confusing segmentation with encryption: segmentation blocks traffic; encryption scrambles it. They are not the same. - Forgetting that ACLs (Access Control Lists) on routers can implement segmentation, but they are harder to manage than VLANs or firewalls.
Key definitions to memorise:
VLAN: A virtual LAN that segments traffic at Layer 2 of the OSI model.
Subnet: A logical subdivision of an IP network.
DMZ (Demilitarised Zone): A segment that exposes public-facing servers (like a web server) while keeping the internal network isolated.
East-West traffic: Traffic between servers inside a data centre (the most important threat vector for lateral movement).
North-South traffic: Traffic entering or leaving a data centre.
The exam will also ask you to identify the correct placement of a firewall in a segmented network. Know that a next-generation firewall (NGFW) sits at the border between segments and can inspect application-layer traffic, unlike a simple packet-filtering firewall.
Segmentation divides a network into isolated zones to prevent attackers from moving laterally after a breach.
Micro-segmentation isolates individual workloads or applications, offering finer control than traditional VLANs.
VPNs encrypt remote connections, but they do not replace the need for internal segmentation.
Network Access Control (NAC) scans every device before granting network access and quarantines non-compliant devices.
Flat networks are never the right answer in CAS-005 scenarios that require security.
East-west traffic (between servers inside the data centre) is the primary attack vector that segmentation aims to control.
Zero Trust architecture relies on segmentation and micro-segmentation as foundational principles.
A DMZ isolates public-facing servers, but servers inside the DMZ still need their own segmentation rules.
These come up on the exam all the time. Here's how to tell them apart.
Segmentation (VLAN)
Operates at Layer 2 (switching) and groups devices into broad categories.
Uses VLANs or subnets to create boundaries between groups of devices.
Traffic between VLANs requires a router or firewall. Rules are coarse-grained.
Micro-segmentation
Operates at Layer 3-7 or at the host level, focusing on individual workloads.
Uses software-defined networking or host-based firewalls to control traffic between single applications.
Rules are fine-grained, allowing or blocking specific ports and protocols between specific workloads.
Site-to-site VPN
Connects two entire networks (e.g., main office and branch office).
Typically uses IPsec protocol and dedicated hardware at both ends.
All devices in both networks can communicate as if they were on the same local network.
Remote-access VPN
Connects a single remote user to the corporate network.
Often uses SSL/TLS protocol and runs as software on the user's device.
Only the user's device gets encrypted access; other devices in the same location do not.
Pre-admission NAC
Scans the device before granting network access.
Blocks non-compliant devices from reaching any internal resources.
Higher security because infected devices are kept out entirely.
Post-admission NAC
Scans the device after it has already connected to the network.
Can only restrict access to certain resources, but the device is already inside.
Less secure because malware can propagate during the scan window.
Flat Network
All devices can communicate with each other directly.
No barriers between workstations, servers, and printers.
Lateral movement is trivial once an attacker gains a foothold.
Segmented Network
Devices are grouped into isolated VLANs or subnets.
Firewall rules control which traffic can cross between groups.
Lateral movement is blocked or severely restricted.
Mistake
Segmentation means buying a bigger firewall and putting everyone behind it.
Correct
Segmentation means dividing the network into separate zones with controlled communication between them. A single firewall with all zones on one interface offers minimal isolation.
Beginners confuse perimeter security with internal segmentation because early network security focused only on the outer wall.
Mistake
Micro-segmentation is just a fancy name for VLANs.
Correct
Micro-segmentation isolates individual workloads or applications, often using software-defined networking or host-based firewalls, while VLANs separate groups of devices at the network level. They are different scales of isolation.
Marketing materials sometimes blur the terms, and beginners think they are synonyms. They are not.
Mistake
If you have a VPN, you do not need segmentation.
Correct
A VPN encrypts traffic between two points but does not control what happens once the traffic arrives inside the network. Segmentation still required to limit lateral movement.
It is intuitive to think that encryption equals total security, but encryption only protects data in transit, not at rest in the internal network.
Mistake
NAC is only for blocking outsiders, not for checking internal employee devices.
Correct
NAC checks every device trying to join the network — including employees' laptops — to enforce security policies before granting access.
People assume 'network access control' only applies to guests or contractors, but modern NAC policies apply to all devices equally.
Mistake
Putting a server in a DMZ makes it completely secure.
Correct
A DMZ reduces risk by isolating public-facing servers from the internal network, but those servers can still be compromised. Segmentation within the DMZ itself is still necessary.
The name 'demilitarised zone' sounds like a safe area, but servers in a DMZ are still exposed to internet threats.
Mistake
Micro-segmentation is too expensive and only used by big tech companies.
Correct
Micro-segmentation is increasingly available through cloud providers (like AWS security groups) and software-defined networking solutions, making it affordable for small and medium businesses.
Legacy hardware-based segmentation was expensive, but cloud-native tools have democratised micro-segmentation.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Yes, segmentation can stop ransomware from spreading by isolating infected devices in their own VLAN. If a laptop is infected, it cannot reach servers or other workstations on different VLANs because the firewall blocks that traffic.
A VLAN is a virtual network that separates traffic at Layer 2 (switching level), while a subnet is a logical IP address range at Layer 3 (routing level). In practice, VLANs are often paired with subnets so that each VLAN corresponds to a unique subnet.
Yes. VPNs secure the connection over the internet by encrypting data. Segmentation controls traffic inside the network. They address different risks: VPNs protect data in transit, segmentation limits lateral movement.
No. NAC checks device health and enforces policy before granting access. A firewall controls traffic between networks after access is granted. They are complementary tools.
A DMZ (Demilitarised Zone) is a separate network segment that sits between the public internet and your private internal network. You place public-facing servers like web servers there so that even if the web server is attacked, the attacker cannot reach your internal database.
Not necessarily. Many cloud platforms (AWS, Azure, GCP) offer micro-segmentation through built-in security groups and network policies. In on-premises environments, software-defined networking or host-based firewalls can achieve it without dedicated hardware.
East-west traffic refers to data moving between servers within the same data centre or cloud environment, as opposed to north-south traffic which enters or leaves the data centre. Micro-segmentation focuses on controlling east-west traffic to stop lateral movement.
You've finished Network Security Architecture and Segmentation. Continue through the CAS-005 study guide to build a complete picture of the exam.
Done with this chapter?