Cram Sheet · Domain 3.2

Domain 3.2 Study Guide

Securing enterprise infrastructure — CompTIA Security+ SY0-701

Before you read further: a prior quiz showed a clean rotation pattern — each answer landed one slot away from where it belonged, not scattered randomly. That means the underlying knowledge is already there. This guide re-anchors each concept to one distinct word or test, so the mix-up stops happening. Read it once, don't quiz yourself on it — just let it settle.

1. The Four Firewall Types

These four keep sliding into each other's slots because they're all “a box that filters traffic.” The fix is a single anchor word for each, independent of the others.

Type	Anchor	OSI layers	What it does	Best for
Network-based firewall	Plain	3, 4	Filters by IP, port, protocol only. Stateful tracking of connections.	Baseline, every org, every size
UTM / web security gateway	Bundle	3, 4, 7	Firewall + antivirus + IDS/IPS + content filtering, one box, one console.	Small business, no dedicated security staff
NGFW	Sees the app	3, 4, 7	Deep packet inspection, native app identification regardless of port, integrated IPS.	Large enterprise, data center, government
WAF	Web only	7 only	Inspects HTTP/S content specifically. Blocks SQL injection, XSS.	Any public-facing web app, regardless of size

Pattern recognition: “single box, small business” → UTM. “identifies the app even on port 443” → NGFW. “SQL injection / XSS / OWASP” → WAF. “only checks IP/port/protocol, nothing smarter” → network-based firewall.

Why WAF is the one to isolate in your head: WAF is the only one of the four that is exclusively Layer 7 — it has no IP/port filtering ability at all. That's exactly why it never replaces a network firewall; it's always deployed alongside one, sitting in front of the web server specifically.

Why UTM and NGFW get confused: Both span Layers 3, 4, and 7, so the layer numbers alone won't separate them. The real difference is depth versus breadth: UTM bundles several separate point-products (AV engine, IPS engine, filter engine) into one appliance aimed at simplicity and cost. NGFW's Layer 7 capability is one deep, native, integrated app-identification engine aimed at granular enterprise-grade control. If the question emphasizes cost/simplicity/small business, it's UTM. If it emphasizes granularity/app-awareness/enterprise scale, it's NGFW.

2. IDS vs. IPS

IDS — Intrusion Detection System	IPS — Intrusion Prevention System
Passive, out-of-band (a copy of traffic, often via SPAN/tap) Monitors and alerts only Never touches or blocks live traffic	Active, inline (sits directly in the traffic path) Can automatically block or drop malicious packets Real-time enforcement, not just alerting

Mnemonic: D is for Detect (IDS), P is for Prevent (IPS). If the question says the system “blocks” or “drops” traffic, it's IPS, full stop. If it only “alerts” or “logs,” it's IDS.

3. The Access-Control Cluster

Five different controls all sound like “something that decides who gets in.” Each one checks a different thing.

Control	What it actually checks/does
NAC (network access control)	Device health before granting access: patch level, antivirus status, compliance posture
VPN concentrator	Aggregates and manages many simultaneous encrypted VPN tunnels. Does not check device health.
Jump server	A single hardened host all admins must pass through before reaching sensitive internal systems
802.1X	Port-based authentication standard. A port stays closed until the connecting device authenticates (often via RADIUS)
Port security	Layer 2 switch feature restricting which MAC address(es) may use a given port

Common miss, explained: “verifies antivirus and patch level before granting access” is a posture check, and that's NAC's defining trait. A VPN concentrator just terminates encrypted tunnels at scale; it has no concept of checking what's running on the device at the other end.

Relationship worth knowing: 802.1X is often the underlying mechanism NAC uses to enforce its policy. NAC is the broader decision (“is this device healthy enough to admit?”); 802.1X is the port-level gate that carries out that decision.

4. Screened Subnet (DMZ) and Segmentation

Screened subnet / DMZ: a network segment isolated between two firewalls, hosting internet-facing services (web, mail, DNS) so that if one of those services is compromised, the attacker still doesn't have a direct path into the internal LAN.

Segmentation (general principle): dividing a network into zones so a breach in one zone can't easily spread laterally into another. A DMZ is one specific application of this broader principle.

5. Fail-Open vs. Fail-Closed

Fail-closed	Fail-open
On failure, blocks all traffic. Prioritizes security over availability. The default assumption for most security appliances.	On failure, allows all traffic through unfiltered. Prioritizes availability over security. Used only when uptime matters more (e.g. certain life-safety or physical-access systems).

Quick-Skim Cheat Sheet

If the scenario says…	The answer is…
Single box, small business, one console	UTM
Identifies the app even on port 443	NGFW
SQL injection / XSS / OWASP	WAF
Only checks IP / port / protocol	Network-based firewall
Blocks or drops automatically, inline	IPS
Alerts only, passive, out-of-band	IDS
Checks patch level / AV before connecting	NAC
Aggregates many VPN tunnels	VPN concentrator
Hardened single host for admin access	Jump server
Blocks all traffic on failure	Fail-closed
Allows all traffic on failure	Fail-open

Abbreviations

Abbreviation	Stands for
802.1X	IEEE standard for port-based network access control
DMZ	Demilitarized zone (also called a screened subnet)
HTTP/S	Hypertext Transfer Protocol (Secure)
IDS	Intrusion Detection System
IPS	Intrusion Prevention System
IP	Internet Protocol
MAC	Media Access Control (address)
NAC	Network Access Control
NGFW	Next-Generation Firewall
OSI	Open Systems Interconnection (model)
OWASP	Open Web Application Security Project
RADIUS	Remote Authentication Dial-In User Service
SPAN	Switched Port Analyzer (port mirroring)
SQLi	SQL Injection
UTM	Unified Threat Management
VPN	Virtual Private Network
WAF	Web Application Firewall
XSS	Cross-Site Scripting

3. Reading Network Diagrams

The exam will show you a topology and ask you to read it, not just define terms. Four skills, all trained by the same diagram: name the zone by trust level, follow a flow across every boundary it crosses, confirm each device sits where it belongs, and notice when a boundary has nothing guarding it.

Reference architecture: Internet (untrusted) —FW1→ DMZ / semi-trusted (web server, mail server, proxy server, VPN concentrator) —FW2 + inline IPS→ Internal network / trusted (workstations, internal servers: file, DB, DC). A remote user's encrypted VPN tunnel lands in the DMZ, not directly inside the trusted zone — decrypted traffic still has to clear FW2 and the IPS like anything else. An IDS sits as a passive tap off to the side and cannot block anything.

Spot the missing control: any line connecting an untrusted zone straight to a trusted zone, with no device sitting on it, is the vulnerability the exam is testing for. The fix is never “add more rules” to something else; it's placing a control (usually a firewall, sometimes a DMZ as well) directly on that line.

How to Work an Exam Diagram

Name each zone first. Internet or an external network is untrusted. A DMZ or screened subnet is semi-trusted. The internal LAN is trusted. Do this before reading any device labels.
Trace the flow the question asks about. Start at the source, follow the line to the destination, and list every boundary it crosses along the way.
Check what sits on each boundary. A firewall (or NGFW/UTM) is the minimum expected control between zones of different trust. IPS is inline; IDS is a tap off to the side. A VPN concentrator terminates remote tunnels — it does not inspect what's inside them.
Look for the gap. If a line crosses from untrusted straight to trusted with nothing on it, that's the answer to “which control is missing,” every time.

Domain 3.2 · Security+ SY0-701