✍ 10: Security in Network Design — Exercises¶
Tip
Practice — try each question first, then expand the answer to check your reasoning.
Work through each question, then click ▶ Show answer to check yourself. Review the notes if you get stuck.
🧱 Q1. Explain the difference between a stateful and a stateless firewall.¶
Show answer
A **stateful** firewall tracks connection state and automatically permits legitimate **return traffic**. A **stateless** (packet-filter) firewall inspects each packet in isolation with no session awareness.💡 Q2. An ACL has three permit rules and no deny rules. Is traffic matching none of them allowed? Why?¶
Show answer
**No.** Traffic matching no rule hits the **implicit deny all** at the end of the ACL and is dropped.🔹 Q3. Where is an IPS placed relative to traffic, and how does that differ from an IDS?¶
Show answer
An **IPS is inline** so it can actively **block** traffic. An **IDS** is typically **out-of-band** (SPAN/tap) and only **alerts**.🔹 Q4. A public web server must be reachable from the Internet without exposing the internal LAN. What design element solves this?¶
Show answer
A **DMZ (screened subnet)** — the server sits in an isolated segment reachable from the Internet but not connected to the internal LAN, so a compromise there doesn't expose internal systems.🔐 Q5. Match each Layer 2 defense to the attack it stops: port security, DHCP snooping, Dynamic ARP Inspection, BPDU Guard.¶
Show answer
- **Port security** → MAC flooding / rogue devices - **DHCP snooping** → rogue DHCP server - **Dynamic ARP Inspection** → ARP spoofing (MITM) - **BPDU Guard** → rogue switch manipulating STP🔹 Q6. Contrast RADIUS and TACACS+, and give a good use case for each.¶
Show answer
- **RADIUS** (UDP, encrypts password only, combines authn/authz) → **network access / 802.1X**. - **TACACS+** (TCP 49, encrypts whole payload, separates AAA) → granular **device administration**.🔹 Q7. What does AAA stand for, and what does each part do?¶
Show answer
**Authentication** (who are you?), **Authorization** (what may you do?), **Accounting** (what did you do?).🔹 Q8. What does 802.1X provide, and what are the three roles involved?¶
Show answer
Port-based network access control — authentication **before** the port opens. Roles: **supplicant** (client), **authenticator** (switch/AP), **authentication server** (RADIUS).🔹 Q9. Summarize the zero-trust model in one line.¶
Show answer
**"Never trust, always verify"** — no implicit trust based on network location; every access request is authenticated, authorized, and continuously validated.📡 Q10. How do DHCP snooping, Dynamic ARP Inspection, and IP Source Guard work together?¶
Show answer
**DHCP snooping** trusts only uplink ports and builds an IP/MAC/port **binding table**. **DAI** validates ARP against that table (stops ARP spoofing). **IP Source Guard** permits only traffic whose source IP/MAC matches a binding (stops IP spoofing).💡 Q11. Why should unused switch ports be shut down?¶
Show answer
To stop an intruder from plugging into a live port (e.g., in a lobby) and gaining network access. Best practice: disable them and place them in an unused VLAN.🔹 Q12. Give a "defense in depth" chain of controls from the Internet edge inward.¶
Show answer
**Firewall → IPS → DMZ segmentation → NAC/802.1X → monitoring/SIEM.** Layering diverse controls means no single failure exposes the whole network.⬅️ Prev: Module 09 · 📚 All Exercises · Next: Module 11 — Performance & Recovery ➡️
🧭 Bonus Scenario Practice¶
🧩 Case A: Firewall Rule Order¶
A firewall rule set contains these rules in order:
- Deny all traffic to the management subnet.
- Permit IT-admin subnet to SSH to the management subnet.
- Permit users to HTTP/HTTPS.
IT administrators cannot SSH to switches. Why?
Show answer
The deny rule appears before the more specific SSH permit. Because firewalls and ACLs usually process rules top-down and stop at the first match, the admin SSH traffic is denied before it reaches the permit rule. Move the specific permit above the broad deny.🧩 Case B: IDS or IPS?¶
A company wants visibility into suspicious traffic but cannot risk the monitoring device interrupting production traffic if it fails. Should it place an IDS or IPS at that point, and why?