4.1 Security Architecture: Zero Trust, Defense-in-Depth & Threat Vectors
Contrasts perimeter defense with Zero Trust Architecture, detailing targeted attacks including spear phishing, Man-in-the-Middle, and ARP poisoning.
🎯 Key CompTIA Network+ Exam Takeaways
- Zero Trust eliminates implicit trust based on physical location; all requests are authenticated, authorized, and encrypted.
- ARP poisoning floods fraudulent ARP replies, mapping the default gateway IP to the attacker's MAC address to intercept traffic (MitM).
- Spear phishing targets specific high-profile individuals using contextual reconnaissance to steal credentials or initiate fraudulent transfers.
Traditional network security relied on perimeter models (DMZs and firewalls) that granted broad implicit trust to internal LAN users. Zero Trust Architecture (NIST SP 800-207) rejects this assumption under the principle of 'never trust, always verify.
Every request undergoes continuous authentication, posture checking, and microsegmentation. Defense-in-depth layers security controls across physical, network, endpoint, and application layers.
Layer 2 attacks like ARP poisoning exploit the lack of authentication in ARP. Attackers send gratuitous ARP replies associating their MAC with the default gateway IP, redirecting outbound frames through the attacker's machine for eavesdropping.
⚠️ Common Pearson VUE Exam Traps
- Believing internal LAN clients can be implicitly trusted once behind a perimeter firewall.
- Confusing volumetric DoS attacks with Man-in-the-Middle eavesdropping attacks.
Knowledge Checkpoint
An attacker on a corporate switched Ethernet segment sends unsolicited, gratuitous ARP replies to workstations claiming that the MAC address corresponding to the default gateway's IP is the attacker's own MAC. What attack is being executed, and what does it enable?