Securing Enterprise Infrastructure
Given a scenario, apply security principles to secure enterprise infrastructure
What you will learn
- Choose a device's placement and the security zone that suits it.
- Separate fail-open from fail-closed, and know which fits which situation.
- Tell a detection system from a prevention system, and inline from tap mode.
- Name the secure access methods: tunnels, private networks, jump servers and port control.
This objective is about decisions, not names: where a device goes, what happens when it fails, and whether it watches or intervenes. The question describes an environment and asks for the right decision — and what it tests most is the tension between security and continuity.
Zones and placement
| Security zone | An area grouping systems of one trust level. Traffic between zones passes through a control. |
|---|---|
| Screened subnet (DMZ) | A middle zone holding publicly reachable services, so the outside never touches the internal network directly. |
| Jump server | A single hardened crossing point from which sensitive systems are administered. It reduces every admin path to one that is watched. |
| Proxy | An intermediary the traffic passes through to be inspected and logged, hiding what sits behind it. |
| Load balancer | Spreads load across several servers. It serves availability, and partly blunts flooding. |
Detection vs prevention
| IDS — detection | IPS — prevention | |
|---|---|---|
| Placement | Out of path, on a copy of the traffic | Inline, in the path |
| Action | Alerts only | Drops the malicious traffic |
| Cost of a false positive | A spurious alert | Legitimate traffic blocked |
| If it fails | The network keeps running | It can stop all traffic |
Fail-open vs fail-closed
| Fail-open | Fail-closed | |
|---|---|---|
| On failure | Everything passes | Nothing passes |
| What is sacrificed | Security | Availability |
| When to choose it | When the outage is the greater danger: an emergency exit, a hospital network | When the leak is the greater danger: a vault, classified data |
Neither one is the "right" answer
Fail-closed looks like the security answer every time, and it is wrong half the time. A fire door that fails closed traps people inside. Read what costs more in the described scenario: the outage or the leak? The answer follows that, not a general rule.
Secure access and communication
| VPN | An encrypted tunnel across an untrusted network. It protects traffic in transit, not what sits at either end. |
|---|---|
| IPSec / TLS | The two tunnelling protocols. The first works at the network layer; the second sits above it and is common in remote-access tunnels. |
| 802.1X | Port-based access control: a device gets no network until it has authenticated. |
| SD-WAN | Software-defined management of branch links, steering traffic by policy instead of a fixed path. |
| SASE | Network security and access combined into one cloud service near the user, instead of hauling all traffic back to headquarters. |
Real-world example: three decisions in one environment
A company publishes a customer-facing application and wants to administer its servers safely. Placement: the application in a screened subnet the public can reach, the database on the internal network reachable from nowhere outside. Administration: no direct admin access from the internet — one hardened jump server, monitored, requiring multi-factor authentication. Security appliance: an inline prevention system in front of the application, and a detection system on a copy of internal traffic so a false positive cannot stop legitimate work. Notice each decision answers a different question: where, how do we reach it, and do we watch or block.
What matters on the exam
- "Only watches" = IDS, out of path. "Stops the attack" = IPS, inline. Placement follows function.
- Read what costs more before choosing failure behaviour: outage or leak. There is no general rule here.
- A jump server is the answer when the question asks how to administer sensitive systems without exposing them to the internet.
- A VPN protects traffic in transit only. An infected device connecting through one carries its infection inside.
Quick check
Answer in your head first, then reveal.
When do you choose fail-open even though it looks less secure?Reveal the answer
When the outage is more dangerous than uninspected traffic: a hospital network, an emergency exit, a production line. Here security serves safety, not the reverse.
Why is a detection system placed out of path and a prevention system in it?Reveal the answer
Because detection needs only a copy of the traffic, while prevention needs the traffic to pass through it in order to drop anything. The price is that an inline failure can stop the network, while a detector's failure stops nothing.
What is a screened subnet for?Reveal the answer
To put publicly reachable services in a middle zone, so that if one is compromised the attacker is not inside the internal network but still facing another control.
What does 802.1X add to a wired network?Reveal the answer
It stops network access being granted by plugging in a cable: the port passes nothing until the device has authenticated. It closes a vector firewalls never see.
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.