Securing networks
Segment and monitor a network
Use network zones, firewall rules, and traffic evidence to limit exposure.
Work through defensive scenarios and explain the evidence behind each decision.
Define the permitted connections
A guest device should not have the same access as a staff workstation. Segmentation creates network zones so an incident in one zone has fewer paths to other assets. Write down the connections each service actually needs before choosing firewall rules.
A rule can examine source, destination, protocol, and port. Allowing an application to receive encrypted web traffic does not justify allowing every inbound connection. Test allowed traffic and blocked traffic after a rule change.
| Source | Destination | Decision |
|---|---|---|
| Guest zone | Public internet | Allow approved services |
| Guest zone | Staff database | Deny |
| Application | Database | Allow required connection |
Interpret evidence in context
Repeated connection attempts to many ports may justify investigation. Compare the traffic with the normal pattern and with authorized maintenance. One unusual record is evidence to examine, not a complete explanation of an incident.
Wireless protection also needs secure authentication, maintained access points, and separation of guest access. An encrypted wireless link does not make a compromised device trustworthy.
Check yourself
Does segmentation guarantee that an attack cannot spread?Show answer
No. It restricts paths, but allowed connections and misconfigured controls can still provide routes. Test the boundaries.
References used to build these lessons
We used these official documents as references when building this course's lessons. They are the sources for the syllabus structure and course requirements.
College Board · Effective fall 2026