3.2 Secure Network Topologies, DMZs, and Perimeter Appliances

🎯 Key CompTIA Security+ Exam Takeaways

• Demilitarized Zones (DMZs / screened subnets) isolate public-facing internet services from internal corporate networks.
• Next-Generation Firewalls (NGFW) inspect traffic up to Layer 7, providing deep packet inspection, application awareness, and TLS decryption.
• Web Application Firewalls (WAF) inspect Layer 7 HTTP/HTTPS traffic to defend web applications from OWASP Top 10 exploits.
• Intrusion Prevention Systems (IPS) sit inline to drop malicious packets in real time; Intrusion Detection Systems (IDS) operate out-of-band to monitor and alert passively.
• Air-gapped networks and hardware data diodes provide physical isolation for mission-critical industrial SCADA/ICS environments.

Perimeter defense requires strategic topology design. A Demilitarized Zone (DMZ) or screened subnet sits between the untrusted internet and the trusted internal corporate network. Public-facing servers (web, mail, external DNS) reside in the DMZ. If a web server in the DMZ is compromised, firewall rules strictly forbid outbound connections from the DMZ into internal subnets, preventing direct lateral compromise of internal databases.

Perimeter filtering has advanced from simple Layer 4 packet filters to Next-Generation Firewalls (NGFW). Operating across Layers 3 through 7, an NGFW performs deep packet inspection (DPI), identifies applications regardless of port numbers, terminates and decrypts SSL/TLS traffic, and blocks known malware signatures in real time. Web Application Firewalls (WAF) complement NGFWs by focusing exclusively on inspecting Layer 7 HTTP/HTTPS web transactions, blocking attacks like SQL injection and cross-site scripting.

Traffic monitoring relies on IDS and IPS appliances. An Intrusion Detection System (IDS) is deployed out-of-band via a network TAP or switch SPAN port, passively copying packets to generate security alerts without introducing network latency. An Intrusion Prevention System (IPS) sits directly inline in the packet path, actively inspecting and dropping malicious packets in real time before they reach target endpoints. In critical Operational Technology (OT) and SCADA networks, physical air-gapping or unidirectional hardware data diodes ensure physical one-way data exfiltration without any possibility of inbound cyberattacks.

⚠️ Common Pearson VUE Exam Traps

• Placing backend database servers in the DMZ alongside public web servers; databases must reside on isolated internal private subnets.
• Confusing NGFW with WAF; an NGFW protects the network perimeter across all protocols, while a WAF specifically inspects HTTP/HTTPS web application payloads.