Network security fundamentals and architectures. The way you design and connect the parts of a computer network determines everything about how secure that network is. For the SSCP exam, you must understand these building blocks and patterns because every security control works only within the structure you have created.
Jump to a section
A simple way to picture Network Security Fundamentals and Architectures
A building superintendent manages a large apartment complex with hundreds of residents. They control who gets in through the main lobby door, who can use the package delivery room, and which maintenance workers are allowed into individual apartments. They also decide which parts of the building get secured after hours and how the intercom system connects residents to visitors. The superintendent does not handle the plumbing or electrical repairs directly but ensures that the systems for access control, communication, and resource sharing are designed and working correctly.
The complex has a blueprint (the network architecture) showing every hallway, stairwell, and utility closet. The superintendent uses this to decide where to install locks, cameras, and signs. When a new shop opens on the ground floor, the superintendent creates a separate entry (a subnet) so shop customers cannot wander into residential hallways. They also set rules for guests (visiting IP addresses) and make sure the elevator (the core switch) only takes people to floors they are allowed to visit. If a suspicious person tries to tailgate through the main door (an unauthorised access attempt), the superintendent reviews the lobby footage (logs) and updates the key fob system (updates firewall rules). The job never stops because the building runs 24/7. This is exactly how a network architect or security engineer designs, segments, and protects an organisation's computer network.
A network is simply two or more computers connected so they can share data. Think of it as a postal system where devices (computers, printers, servers) act like houses, and data travels in envelopes called packets. Every packet has a source address and a destination address, just like a letter. For these packets to travel correctly, the network needs a design, and that design is the network architecture.
At the most basic level, you have three kinds of devices. A switch connects devices within the same local area (like the same office floor). It looks at the hardware address (MAC address) of each device to decide where to send packets. A router connects different networks together, like linking the office to the internet. It reads the IP address (a logical address like a postal code) to find the best path for each packet. A firewall sits between networks and enforces rules about which traffic is allowed to pass. It is like a gatekeeper who checks every letter before it enters or leaves the building.
Network architectures describe how these devices are arranged. The most common model is the OSI model (Open Systems Interconnection), which breaks the network into seven layers, from the physical cable (Layer 1) all the way up to the applications you use (Layer 7). For SSCP, you mostly need to know three layers: the Network Layer (Layer 3) where IP addresses work, the Transport Layer (Layer 4) where TCP and UDP protocols manage how data is sent reliably or quickly, and the Application Layer (Layer 7) where your email or web browser operates.
Beyond the OSI model, there are two major architectural patterns. A flat network is one where every device can talk directly to every other device. It is simple but dangerous because if one device gets infected with malware, it can reach everything else. A segmented network breaks the network into smaller sections called subnets or VLANs. For example, the human resources department might be in one subnet, and the public guest Wi-Fi in another. A firewall or router controls traffic between these segments. This limits damage and is a core security strategy called defence in depth.
Network security models are also crucial. The perimeter model assumes everything inside the office network is safe and everything outside is dangerous. This worked when people only worked in the office, but it fails now with remote work and cloud services. The zero trust model assumes no device or user is trustworthy, even if they are inside the network. Every request must be authenticated and authorised. The defence in depth model layers multiple security controls (firewalls, antivirus, intrusion detection systems) so if one fails, another catches the threat.
Key components you must know for SSCP include:
DMZ (Demilitarised Zone): a special subnet placed between the internal network and the public internet. Public-facing servers like web servers live here so that if they are hacked, the attacker still cannot reach the internal network.
VPN (Virtual Private Network): an encrypted tunnel that lets a remote user connect to the office network securely over the internet.
NAT (Network Address Translation): a technique that lets many devices in a private network share a single public IP address. It also hides internal IP addresses from the outside.
IDS/IPS (Intrusion Detection System / Intrusion Prevention System): systems that monitor network traffic for suspicious patterns and either alert or automatically block malicious activity.
The overall goal of network security architecture is to control access, protect data in transit, and ensure that an attack on one part does not compromise the whole system. For SSCP, you need to know the names, purposes, and interactions of these components.
Identify Assets and Requirements
First, list all the data, servers, and applications that need protection. Determine who needs access and from where. This step defines what the network architecture must secure.
Design Network Segments
Divide the network into VLANs or subnets based on teams (Finance, HR, R&D) and data sensitivity. Create a separate DMZ for any servers that must be reachable from the internet. This step limits the movement of an attacker.
Place Firewalls and Define Rules
Install firewalls between each segment (between the internet and the DMZ, between the DMZ and the internal network, and between internal segments if needed). Write ACL rules that specify exactly which traffic is permitted, using the principle of least privilege.
Implement Remote Access Controls
Set up a VPN appliance for remote workers. Configure it with strong encryption and require multi-factor authentication. Also ensure that remote devices meet security policies (e.g., updated antivirus) before they are granted access.
Deploy Monitoring and Detection Systems
Install an IDS/IPS on critical network choke points, such as the main internet gateway and between the DMZ and internal network. Configure logging to a central SIEM system so that security events are collected and reviewed regularly.
Document and Review Architecture
Create a detailed network diagram showing all devices, IP ranges, firewall rules, and VLANs. Review and update this documentation whenever changes are made. This step is essential for incident response, auditing, and troubleshooting.
An IT security professional does not just read about these concepts; they build and maintain them daily. Consider a medium-sized company called GreenLeaf Consulting with 200 employees. The IT manager, Priya, must design a new network for their new office and support 50 remote workers.
First, Priya examines the floor plan and decides on network segmentation. She places the finance team in a separate VLAN because they handle sensitive customer payment data. The research and development team is in another VLAN because their prototype designs are confidential. The guest Wi-Fi is in a third VLAN that has no access to any internal systems. She configures the core switch to tag these VLANs and sets up a firewall rule that allows the guest network only to access the internet, not the internal servers.
Next, she deploys a DMZ. GreenLeaf hosts a public website and an email server. Priya places both servers in the DMZ, behind the main firewall but still separated from the internal network. She writes firewall rules that allow internet users to reach the web server on port 443 (HTTPS) and port 25 (SMTP) to the email server, but those servers cannot initiate connections into the internal network. If a hacker exploits a vulnerability in the web server, they are trapped in the DMZ and cannot move sideways into the payroll database.
For the 50 remote workers, Priya sets up a VPN appliance. Each worker installs a VPN client on their laptop. When they connect, the client creates an encrypted tunnel to the VPN appliance at the office. The worker's laptop receives a virtual IP address from the office network range. Priya configures the firewall to allow traffic from the VPN subnet into the internal network only after multi-factor authentication via Microsoft Entra ID.
Priya also installs an intrusion detection system (IDS) that monitors all traffic crossing the main firewall. It looks for patterns like port scans, known exploit signatures, or large data transfers during off-hours. When it detects something suspicious, it logs the event and sends an alert to her phone. She reviews these logs every morning.
Finally, she documents everything. She draws a network diagram showing every switch, router, firewall, VPN concentrator, and server. She labels all IP ranges, VLAN IDs, and firewall rule numbers. This diagram is critical for troubleshooting, onboarding new staff, and passing security audits. When an auditor asks, 'How do you prevent a guest from accessing finance data?' Priya points to the diagram and the firewall rule base.
In a real workplace, Priya also uses tools like:
Network mapping tools (e.g., Nmap) to discover all devices on each subnet.
Configuration management tools to ensure all switches and firewalls have consistent, hardened settings.
Log aggregation systems (SIEM) to centralise and analyse security events from all network devices.
Vulnerability scanners to check if any device in the DMZ has unpatched software.
The SSCP exam tests objective 5.1 through multiple-choice questions that ask you to identify, compare, and apply network components and architectures. You will not be asked to configure a switch, but you must know what each component does and where it fits.
Common question types include:
You are given a scenario (e.g., 'A company wants to host a public web server without exposing the internal network') and must choose the correct architecture (the answer is DMZ).
You are asked the difference between a switch and a router. The trap: both move data, but a switch works at Layer 2 (MAC addresses) within a network, while a router works at Layer 3 (IP addresses) between networks.
Questions about which OSI layer corresponds to which protocol. For example, 'At which layer does IP operate?' Answer: Layer 3 (Network Layer).
Identifying the purpose of network segmentation. The trap: candidates think it improves speed (it can, but the security reason is to limit the blast radius of an attack).
Concepts SSCP loves to test:
DMZ definition and purpose.
VLANs and subnets as segmentation methods.
Stateful vs stateless firewalls (stateful remembers connection state; stateless examines each packet alone).
NAT and how it provides a security benefit by hiding internal addresses.
Defence in depth as a principle (layering multiple controls).
Zero trust model (never trust, always verify) vs perimeter model.
Trap patterns to watch for:
Confusing 'router' with 'switch' in scenario questions.
Thinking a DMZ is identical to a VPN (they both separate traffic, but a DMZ is for public servers, a VPN is for remote user access).
Choosing 'encryption' when the question asks about the first line of defence (firewall is the first line).
Assuming all network security is done at the firewall (IDS/IPS, segmentation, and ACLs on switches are also vital).
Misremembering OSI layer numbers: Layer 2 is Data Link, Layer 3 is Network, Layer 4 is Transport, Layer 7 is Application.
Key definitions to memorise:
MAC address: a hardware address burned into the network interface card, used within a local network segment.
IP address: a logical address used to route packets across multiple networks.
TCP: a connection-oriented, reliable transport protocol. UDP: connectionless, faster, no guarantee of delivery.
ACL (Access Control List): a set of rules on a router or firewall that permits or denies traffic based on source IP, destination IP, port, and protocol.
You should also know that network security architecture directly supports the CIA triad (Confidentiality, Integrity, Availability). Segmentation and firewalls protect confidentiality. IDS/IPS helps maintain integrity by detecting tampering. Redundant links and load balancers ensure availability. Any exam answer that violates the CIA triad is nearly always wrong.
A network architecture defines how devices connect and communicate; security architecture defines how to protect those connections.
The DMZ is a separate network segment for public-facing servers that isolates them from the internal network, not a single device.
Firewalls inspect traffic based on rules; they are not self-learning security systems and require human configuration and maintenance.
Network segmentation (VLANs and subnets) is a primary defence-in-depth strategy that limits the blast radius of a security incident.
Zero trust architecture requires verification of every access request regardless of where it originates, unlike the older perimeter model.
The OSI model has seven layers; SSCP focuses on Layer 3 (Network/IP), Layer 4 (Transport/TCP, UDP), and Layer 7 (Application/HTTP, SMTP).
VPNs encrypt data in transit between a remote user and the network, but do not protect the endpoint device from compromise.
Defence in depth means using multiple overlapping security controls so that if one fails, others still provide protection.
These come up on the exam all the time. Here's how to tell them apart.
Switch
Operates at Layer 2 (Data Link) using MAC addresses
Connects devices within the same local network
Cannot perform NAT or route between different IP networks
Router
Operates at Layer 3 (Network) using IP addresses
Connects different networks together
Can perform NAT, enforce ACLs, and choose paths between networks
Perimeter Model
Assumes everything inside the network is trusted
Relies on a strong boundary firewall
Vulnerable to insider threats and lateral movement
Zero Trust Model
Assumes no device or user is trusted by default
Requires verification for every access request
Designed to limit lateral movement even after a breach
Stateful Firewall
Tracks the state of active connections
Can allow return traffic automatically for allowed outbound connections
More secure for complex traffic patterns
Stateless Firewall
Examines each packet independently
Must have explicit rules for all traffic directions
Faster but less context-aware
TCP (Transmission Control Protocol)
Connection-oriented, establishes a session before data transfer
Guarantees delivery with acknowledgements and retransmissions
Slower but reliable; used for web, email, file transfer
UDP (User Datagram Protocol)
Connectionless, no session establishment
No guarantee of delivery or ordering
Faster; used for streaming, VoIP, DNS queries
Flat Network
All devices can communicate directly with each other
Simple to set up but no isolation between departments
A single compromised device can infect the entire network
Segmented Network
Devices are grouped into VLANs or subnets
Traffic between segments is controlled by firewalls or routers
Limits the blast radius of a security incident
Mistake
A firewall blocks all attacks automatically after installation.
Correct
A firewall only blocks traffic that matches its configured rules. It must be correctly configured and regularly updated to block new types of attacks. It cannot stop attacks that use permitted ports or application-layer threats.
Beginners see firewalls as magic shields, but they are rule-based gatekeepers. Marketing often oversimplifies their capability.
Mistake
Putting a server in the DMZ makes it fully secure because it is separated from the internet.
Correct
The DMZ is still accessible from the internet (by design). The server is only protected from full internal network access. It can still be hacked, and if compromised, it can be used to attack other DMZ hosts or attempt to pivot to the internal network through firewall misconfigurations.
The name 'demilitarised zone' sounds like a no-man's land, but it is not a safe zone. It is a controlled exposure point.
Mistake
VPN encryption guarantees the entire network is safe.
Correct
VPN encryption protects data in transit between the remote device and the VPN gateway. It does not protect the endpoint device from malware, does not prevent the user from visiting malicious sites, and does not secure traffic after it leaves the VPN gateway inside the internal network.
People confuse 'encrypted' with 'secure'. Encryption solves only one piece of the security puzzle (confidentiality in transit).
Mistake
Network segmentation only improves performance, not security.
Correct
Segmentation primarily improves security by limiting the spread of malware and restricting unauthorised access. Performance improvement is a secondary benefit from reduced broadcast traffic. The security advantage (containment of breaches) is the main reason it is used in security architecture.
Segmentation is often taught in IT courses as a way to reduce network congestion, so security learners overlook its defensive role.
Mistake
A switch is the same as a hub but faster.
Correct
A hub blindly repeats every packet to all ports, meaning any device can see all traffic. A switch sends each packet only to the specific port of the intended recipient device, which provides basic confidentiality and reduces unnecessary traffic. They operate differently at Layer 2.
Both connect devices, so beginners assume they do the same job. The difference in how they handle data is crucial for security.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A DMZ (Demilitarised Zone) is a separate network segment placed between the internal network and the public internet. Public-facing servers such as web and email servers are placed there so that they are accessible from the internet without exposing the internal network.
No. You must know the names and order of the seven layers, but the exam focuses on Layer 3 (Network, IP), Layer 4 (Transport, TCP/UDP), and Layer 7 (Application). You should also understand that switches work at Layer 2 and routers at Layer 3.
A switch connects devices within the same local network and uses MAC addresses to forward data. A router connects different networks together and uses IP addresses to route data between them. Routers can also perform NAT and enforce firewall rules.
A firewall is a critical first line of defence, but it is not sufficient alone. You must also use segmentation, IDS/IPS, strong authentication, encryption, and regular patching. This layered approach is called defence in depth.
Zero trust means never automatically trust any user or device, even if they are inside the corporate network. Every access request must be verified, authenticated, and authorised. It replaces the old model where everything inside the network was considered safe.
Segmentation breaks the network into smaller isolated sections. If an attacker compromises one segment, they cannot easily move to other segments. This limits the damage of a breach and protects sensitive systems from unauthorised access.
A VLAN (Virtual Local Area Network) is a logical grouping of devices that act as if they are on the same physical network, even if they are not. A subnet is a range of IP addresses. VLANs are implemented on switches at Layer 2; subnets are a Layer 3 concept. They are often used together for segmentation.
You've finished Network Security Fundamentals and Architectures. Continue through the SSCP study guide to build a complete picture of the exam.
Done with this chapter?