The 200-201 exam objective 2.2 covers 'Explain network infrastructure and common protocols'. Networking fundamentals for security is the foundation of everything a CyberOps analyst does — without understanding how data moves, you cannot spot when it is being moved somewhere it should not be. This concept matters because attackers exploit misconfigurations in network devices and protocols, and if you cannot tell the difference between normal and malicious traffic, you will miss the attack entirely.
Jump to a section
A simple way to picture Networking Fundamentals for Security
A postal worker named Priya manages the sorting office for a busy city. Her job is to make sure every letter and parcel reaches the right person, safely and on time.
Every morning, a truck arrives with bags of mail. Priya doesn't just toss everything into one pile — she first checks the address on each item. The address tells her the recipient's unique location, just like an IP address is a unique identifier for a device on a network. She then sorts mail by destination city, which is like a router forwarding traffic between different networks. If a letter needs to go abroad, she passes it to an international courier, similar to how a network gateway connects one type of network to another.
Some letters are marked 'Urgent — Handle with Care'. Priya flags these for priority processing, much like how network protocols can mark certain packets as high-priority for applications like video calls. She also logs every item in her system, tracking when it arrived and where it went — this is analogous to logging network traffic for security analysis.
If a parcel looks damaged or suspicious, Priya pulls it aside for inspection, just as firewalls inspect packets for threats before letting them through. She also requires a signature for valuable packages, which resembles how TCP ensures reliable delivery by acknowledging receipt of data segments.
Priya's sorting office is the whole network infrastructure — routers, switches, cables, and security tools — working together to deliver data reliably and securely.
Networking fundamentals for security means understanding how computers talk to each other and what tools they use to do it safely.
At its simplest, a network is just two or more devices connected so they can share data. Your home Wi-Fi connects your phone, laptop, and printer — that is a network. A corporate network might connect thousands of devices across multiple offices and data centres.
Every device on a network has an IP address — think of it like a phone number for that device. When your computer wants to send a message to a server, it writes the server's IP address on the packet (a small chunk of data) and sends it out. Routers are devices that look at the destination IP address and decide the best path to forward the packet along. Routers connect different networks together — for example, your home network to the internet.
Switches are different. They connect devices within the same network — like a switch in your office desk connecting your computer, printer, and phone. Switches use MAC addresses (a hardware address burned into each network card) to deliver data to the right device inside the local network.
Firewalls are security devices that inspect network traffic and decide what to allow or block based on rules. A firewall might block all traffic from outside the network except for web traffic on port 80 (HTTP) and 443 (HTTPS). Firewalls can be hardware appliances or software running on a server.
Protocols are the rules for communication. They define how data is formatted, addressed, transmitted, and received. The most important protocol for security analysts to understand is TCP/IP — Transmission Control Protocol/Internet Protocol. TCP breaks data into packets, numbers them, and ensures they all arrive in order. IP handles the addressing and routing.
Common protocols that appear on 200-201 include:
HTTP (port 80) — unencrypted web traffic
HTTPS (port 443) — encrypted web traffic using TLS/SSL
DNS (port 53) — translates domain names (like google.com) into IP addresses
DHCP (port 67/68) — automatically assigns IP addresses to devices when they join a network
SMTP (port 25) — sends email
FTP (port 21) — transfers files, but is often insecure
SSH (port 22) — secure remote access to devices
SNMP (port 161/162) — monitors and manages network devices
Ports are like extension numbers for services. A single server with one IP address can run multiple services — web server on port 80, email on port 25, SSH on port 22. The port tells the receiving device which application should process the incoming data.
Network traffic can be classified as unicast (one-to-one), broadcast (one-to-all within a network), or multicast (one-to-many, but only interested receivers). Broadcast traffic is important because it is used by ARP (Address Resolution Protocol) to find the MAC address for a given IP address — but too much broadcast traffic can slow a network.
For security, knowing the difference between TCP and UDP (User Datagram Protocol) is critical. TCP is connection-oriented — it establishes a connection before sending data, verifies every packet arrived, and resends lost packets. It is reliable but slower. UDP is connectionless — it just sends packets without checking if they arrive. It is faster but unreliable, used for streaming video, VoIP (voice calls), and DNS queries. Attackers often exploit UDP because it is easier to spoof.
Network infrastructure devices themselves need to be secured. Default passwords on routers and switches are a huge risk. SNMP community strings (like passwords) are often left as 'public' or 'private', letting attackers read or write configuration. Telnet sends passwords in plaintext — SSH should always be used instead.
Segmenting a network using VLANs (Virtual Local Area Networks) separates traffic between different departments or security zones without needing separate physical cables. A VLAN allows the same physical switch to isolate HR computers from guest Wi-Fi, for example. Segmentation limits the damage if one part of the network is breached.
Finally, network monitoring tools like Wireshark capture and analyse traffic. A security analyst looks for unusual patterns — traffic to known malicious IPs, unexpected protocol usage, or large amounts of data leaving the network (data exfiltration). Understanding normal network behaviour is the prerequisite to spotting anomalies.
Device Connects to Network
When a computer joins a network, it sends a DHCP Discover broadcast to find a DHCP server. The DHCP server responds with an IP address, subnet mask, default gateway (router address), and DNS server addresses. This is how the device gets its logical identity on the network. Without DHCP, every device would need manual IP configuration, which is impractical at scale.
ARP Resolves IP to MAC
When the device wants to send data to another device on the same local network, it needs the destination MAC address. It sends an ARP (Address Resolution Protocol) broadcast: 'Who has IP address X?'. The device with that IP responds with its MAC address. The sender caches this mapping so it does not have to ask again soon. ARP spoofing is a common attack where a malicious device sends fake ARP replies to intercept traffic.
Packet Constructed with TCP Header
The application (e.g., a web browser) generates data. TCP breaks this data into segments, adds a header with source and destination port numbers, a sequence number for ordering, and a checksum for integrity. If the application uses UDP, the header is simpler — no sequence numbers and no guarantee of delivery. The choice of TCP vs UDP affects security monitoring because TCP connections have a handshake (SYN, SYN-ACK, ACK) while UDP does not.
Router Forwards Packet Between Networks
The packet is sent to the default gateway (router). The router looks at the destination IP address and checks its routing table to find the best path. If the destination is on a different network, the router forwards the packet to the next-hop router. This process repeats until the packet reaches the destination network. Routers do not inspect the contents of the packet — they only look at the destination IP. A firewall, in contrast, does inspect contents.
Firewall Filters Traffic Based on Rules
When the packet arrives at the destination network's firewall, the firewall checks it against its access control list (ACL). Rules are evaluated in order. If a rule matches, the firewall applies the action — permit or deny. If no rule matches, the default action (usually deny) applies. For example, a firewall might allow inbound traffic on port 443 (HTTPS) to the web server but block everything else. This is how organisations protect internal resources from the internet.
Destination Device Processes and Acknowledges
The destination server receives the packet. If using TCP, it sends an acknowledgment (ACK) back to the sender. If any packets were lost, the sender retransmits them. The application then processes the data — for example, the web server returns a webpage. The response follows the same steps in reverse. Security analysts look for unusual patterns in these steps, such as many SYN packets without ACKs (a SYN flood attack) or data leaving the network to unknown destinations (data exfiltration).
A mid-sized retail company called ShopFast has 200 employees across its head office, a warehouse, and a small remote office. The company's network includes routers connecting each site to the internet, switches connecting computers within each site, and a firewall at the head office that acts as the main security boundary.
A CyberOps analyst named James starts his day by checking the network monitoring dashboard. He sees a spike in traffic from a workstation in the warehouse to an external IP address he does not recognise. He opens Wireshark and captures a packet sample from that workstation's traffic.
Step by step, he analyses the captured data:
He looks at the source IP and destination IP to confirm it is the warehouse machine talking to the unknown external server.
He checks the port numbers — the traffic is using an unusual high-numbered port (4444), not standard ports like 80 or 443. That is suspicious because legitimate web traffic uses ports 80 or 443.
He inspects the protocol in the TCP header — the traffic appears to be raw data, not HTTP or HTTPS. This looks like a custom protocol.
He cross-references the destination IP against threat intelligence feeds — the IP is flagged as a known command-and-control server used by malware.
James now has evidence. He checks the company's firewall logs to see if any rules are blocking this traffic. He finds that the firewall has an overly permissive outbound rule that allows all traffic from the warehouse subnet to the internet. This misconfiguration — no restriction on outbound traffic — is what the attacker exploited.
He immediately creates a firewall rule to block all traffic from the warehouse workstation to the malicious IP. He also quarantines the workstation by disconnecting it from the network switch — a process called network isolation.
In a real-world security incident, the analyst would also:
Use ARP tables on the switch to find which physical port the infected machine is connected to.
Check DHCP logs to see when the device received its IP address.
Look at the DNS logs to see which domains the device tried to resolve.
Perform a risk assessment to decide if the entire warehouse subnet needs to be scanned for other infected machines.
Finally, James writes an incident report. He documents the source IP, destination IP, ports, protocol, firewall rule that allowed the traffic, and the steps taken to isolate the machine. This report goes to the security team for review and to the network team so they can fix the overly permissive firewall rule.
The 200-201 exam tests your understanding of network infrastructure and common protocols directly in several ways. The exam is not asking you to design a network — it is testing whether you can identify components, explain their purpose, and recognise security implications.
Here is exactly what to expect:
Scenario-based questions: You are given a description of a network setup (e.g., 'A company has a firewall between its internal LAN and the internet. An analyst sees traffic from an internal workstation to an external IP on port 3389.') You must identify which protocol is in use (RDP), why it is dangerous (RDP exposed to the internet is a common attack vector), and what security rule should exist.
Port and protocol matching: You will be asked to match a standard port number with its associated protocol or service. The exam loves: 21 (FTP), 22 (SSH), 23 (Telnet — insecure), 25 (SMTP), 53 (DNS), 80 (HTTP), 110 (POP3), 143 (IMAP), 443 (HTTPS), 3389 (RDP). You must also know whether the protocol is TCP or UDP.
Trap questions: The exam tries to trick you by listing a port with a slightly wrong number. For example, they might say 'SMTP uses port 53' — you must know that is DNS. Or they might say 'HTTPS uses port 80' — you must know that is HTTP. Always double-check the number.
Firewall rule interpretation: You may see a simplified ACL (Access Control List) and be asked to determine what traffic is allowed or denied. Example: 'permit tcp any any eq 80' allows all inbound HTTP traffic. You must understand the direction (inbound vs outbound) and the action (permit or deny).
Network device identification: Questions ask 'Which device forwards traffic based on IP address?' — answer: router. 'Which device forwards traffic based on MAC address?' — answer: switch. 'Which device filters traffic based on rules?' — answer: firewall.
Common protocol security issues:
Telnet: sends passwords in cleartext — never use it.
FTP: sends credentials in cleartext — use SFTP or SCP instead.
SNMPv1/v2: community strings sent in cleartext — use SNMPv3 with encryption.
DNS: can be spoofed — use DNSSEC for validation.
DHCP: rogue DHCP servers can give out fake IPs — use DHCP snooping.
TCP vs UDP comparison: You must know that TCP is connection-oriented, reliable, and slower. UDP is connectionless, unreliable, and faster. The exam asks which protocol is used for streaming video (UDP) or for web browsing (TCP).
Key definitions to memorise:
IP address: unique logical identifier for a device on a network.
MAC address: unique physical identifier burned into the network interface card.
Port number: identifies the application or service on a device.
Packet: unit of data transmitted over a network.
Segment: TCP data unit after segmentation.
Frame: data at the data link layer (Layer 2) — includes MAC addresses.
ICMP: used by ping and traceroute for diagnostics.
The exam will also test your understanding of how network topology affects security. For example, a flat network (no VLANs or segmentation) means every device can talk to every other device — if one machine is compromised, the attacker can reach all others. Segmentation limits lateral movement.
TCP is connection-oriented and reliable; UDP is connectionless and faster — know the difference for exam questions on video streaming versus web browsing.
A router forwards traffic between different networks based on IP addresses; a switch forwards traffic within the same network based on MAC addresses.
A firewall filters network traffic based on security rules, not just destination — it is a critical security boundary.
Port numbers 0-1023 are well-known ports assigned to common services (e.g., 80 HTTP, 443 HTTPS, 22 SSH, 53 DNS) — memorise the most tested ones.
Telnet and FTP send credentials in cleartext and are insecure; always use SSH and SFTP instead.
VLANs segment a network logically without extra hardware, limiting the blast radius if a device is compromised.
DNS translates domain names to IP addresses and is a frequent target of spoofing and cache poisoning attacks.
A packet's source and destination IP addresses, plus source and destination port numbers, uniquely identify a network conversation — the 'five-tuple'.
These come up on the exam all the time. Here's how to tell them apart.
TCP
Connection-oriented — a handshake (SYN, SYN-ACK, ACK) establishes the connection before data is sent.
Reliable — uses sequence numbers and acknowledgments to ensure all packets arrive in order, retransmitting lost packets.
Slower due to overhead of connection setup and reliability mechanisms.
UDP
Connectionless — no handshake; data is sent immediately without establishing a connection.
Unreliable — no guarantee packets arrive or arrive in order. No retransmission if packets are lost.
Faster and lower latency — used for streaming video, VoIP, and DNS queries where speed matters more than perfect reliability.
Router
Operates at Layer 3 (Network layer) using IP addresses.
Connects different networks together (e.g., home network to the internet).
Uses routing tables to determine the best path for packets.
Switch
Operates at Layer 2 (Data Link layer) using MAC addresses.
Connects devices within the same network (e.g., computers in an office).
Uses MAC address tables to forward frames to the correct device.
Firewall
Sits inline — all traffic must pass through it.
Actively blocks traffic based on rules (ACLs).
Operates at Layers 3-4 typically, but next-gen firewalls can inspect up to Layer 7.
IDS/IPS
IDS (Intrusion Detection System) monitors traffic passively without blocking it; IPS sits inline and can block.
Analyses traffic for malicious patterns using signatures or anomaly detection.
Operates at Layers 3-7, often with deep packet inspection (DPI) for application-layer threats.
Static IP Address
Manually configured on the device — it never changes.
Used for servers, routers, and other devices that must always have the same IP address.
Requires manual administration — risk of misconfiguration or IP conflicts.
Dynamic IP Address (DHCP)
Automatically assigned by a DHCP server when the device connects to the network.
Used for client devices like laptops, phones, and printers.
Simplifies administration — IP addresses are reused when devices disconnect, reducing wastage.
Mistake
A firewall and a router do the same thing — they both forward traffic.
Correct
A router forwards traffic based on IP addresses to connect different networks. A firewall filters traffic based on security rules — it decides what is allowed and what is blocked, often inspecting content, not just addresses.
Both devices are often combined in a single home router appliance, so beginners think they are the same. In enterprise environments, they are separate devices with distinct roles.
Mistake
Port numbers are physical sockets you plug cables into.
Correct
Port numbers are logical identifiers in the software layer — they are numbers (0-65535) that tell the receiving computer which application should handle the incoming data. Physical sockets are called ports too, which causes confusion.
The same word 'port' is used for both physical connectors (USB port, Ethernet port) and for logical TCP/UDP port numbers. Beginners mix them up because the terminology is overloaded.
Mistake
Every network protocol uses TCP because it is more reliable.
Correct
Many protocols use UDP because speed is more important than reliability. DNS queries, video streaming, VoIP calls, and online gaming all use UDP. Losing one packet in a video call is better than waiting for it to be retransmitted and causing a delay.
Beginners naturally think 'reliable is better' and assume TCP is always used. They do not understand the trade-off between reliability and latency.
Mistake
A MAC address is assigned by the network administrator or DHCP server.
Correct
A MAC address is burned into the network interface card (NIC) by the manufacturer and is supposed to be globally unique. It rarely changes. IP addresses are assigned by DHCP or configured manually — MAC addresses are hardware identifiers.
Because IP addresses are assigned dynamically, beginners assume MAC addresses work the same way. They do not realise the MAC address is permanent at the hardware level.
Mistake
DNS is only used when you first type a website address into a browser — after that it is not needed.
Correct
DNS is used every time your computer needs to connect to a server by name. Every embedded image, script, and API call on a webpage triggers a DNS lookup. DNS traffic is constant throughout a browsing session.
Beginners think the browser caches everything forever. They do not realise how many separate resources a modern website loads, each requiring its own DNS resolution.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A modem connects your home to your internet service provider (ISP) over a cable or phone line. A router connects your devices to each other and to the modem, and it routes traffic between your home network and the internet. Many home devices combine both into one box, but they are separate functions.
Attackers scan ports to find which services are running on a device. If a port is open and the service has a vulnerability, the attacker can exploit it. As a security analyst, you monitor for unexpected open ports or traffic to unusual ports as signs of compromise.
No. TCP is better when every packet must arrive intact, like when sending a file or loading a webpage. UDP is better when speed matters and losing occasional packets is acceptable, like video conferencing or online gaming. Attackers favour UDP for some attacks because it is easier to spoof the source IP.
A broadcast storm happens when many devices on a network send broadcast messages at the same time, flooding the network and using up bandwidth. It can crash switches and make the network unusable. It is often caused by network loops or misconfigured devices.
Telnet sends all data, including usernames and passwords, in plaintext (unencrypted). Anyone on the same network can capture the traffic with a tool like Wireshark and read the credentials. SSH encrypts the entire session, making it safe.
The default gateway is the router that connects your local network to other networks, including the internet. When your computer tries to send data to a device outside its own network, it sends the packet to the default gateway. Without one, your device can only talk to devices on the same local network.
You've finished Networking Fundamentals for Security. Continue through the 200-201 study guide to build a complete picture of the exam.
Done with this chapter?