Networking and Cloud Security Concepts · Topic 2 of 3
Network Security Architecture
Network segmentation with firewall zones, DMZs, VLANs and micro-segmentation, defense in depth, and zero trust, including where to place AI systems and data.
- 3 min
- Includes a diagram
- Segment by trust: internet, DMZ, internal; VLANs and micro-segmentation divide further.
- Segmentation limits lateral movement.
- Defense in depth uses several different layers.
What it is
Network security architecture is how a network is designed so that a single compromise does not expose everything. It divides the network into zones, layers several controls, and, in a zero trust design, checks every request instead of trusting anything by location.
How it works
Segmentation
| Technique | What it does |
|---|---|
| Firewall zones | Group systems by trust (internet, DMZ, internal) with rules between zones |
| DMZ (screened subnet) | Holds internet-facing services, separated from the internal network |
| VLANs | Logically separate groups of devices on the same switches, such as staff, guests and servers |
| Micro-segmentation | Fine-grained rules per workload, limiting movement between servers |
Segmentation limits lateral movement: if one system is compromised, the attacker cannot easily reach others.
Examples:
- A server that answers requests from internet users, such as a public website or an AI inference service, belongs in the DMZ.
- An AI development environment that uses copies of customer data should sit in its own segment, separated from production systems.
- Guest Wi-Fi is isolated from internal systems.
When a question asks where to put an internet-facing server, the answer is the DMZ. When it asks how to protect production from experiments, the answer is a separate segment.
Defense in depth
Defense in depth layers several different controls so that if one fails, others still protect the asset.
| Layer | Example controls |
|---|---|
| Policies and people | Policies, training |
| Physical | Locks, guards |
| Perimeter | Firewalls, email filtering |
| Network | Segmentation, IDS and IPS |
| Endpoint | Antivirus, patching, encryption |
| Application | Input validation, secure coding |
| Data | Encryption, access control, backups |
Zero trust
Zero trust assumes no user, device or system is trustworthy just because it is inside the network. Its key ideas:
- Never trust, always verify: authenticate and authorize every request.
- Least privilege: grant only the access each request needs.
- Assume breach: design as if an attacker is already inside, and monitor continuously.
Under zero trust, an internal AI service asking a records system for data is still verified by identity and policy on each request. Being on the internal network or a "trusted" segment is not enough.
Other architecture elements
- Network access control (NAC) checks devices before they join the network.
- Bastion hosts are hardened systems exposed to untrusted networks for controlled access.
- Implicit deny blocks any traffic not expressly allowed.
How the exam asks about this
- "Where should an internet-facing AI inference server go?" In the DMZ.
- "An internal service requests data under zero trust." It is verified by identity and policy each time.
- "An email filter plus trained staff." Defense in depth.
What to remember for the exam
- Segment by trust: internet, DMZ, internal; VLANs and micro-segmentation divide further.
- Segmentation limits lateral movement.
- Defense in depth uses several different layers.
- Zero trust: never trust, always verify; least privilege; assume breach.
- Keep AI development and test data separate from production.
A VPN link between development and production creates a path between them. To protect production, separate the environments.
Common mistakes
Trusting traffic because it comes from inside the network.
Putting public servers on the internal network.
Layering identical controls and calling it defense in depth.
Check yourself
What is a DMZ used for?
Hosting internet-facing services separately from the internal network.
What does zero trust assume?
That no user, device or system is trusted by default, even inside the network.
Why segment a network?
To limit how far an attacker can move after compromising one system.
Topic 2 of 3 in Networking and Cloud Security Concepts
Test yourself on Networking and Cloud Security Concepts
The full ISC2 CC question bank has 671 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.