A Virtual Private Network that creates an encrypted tunnel over an untrusted network like the internet.
A Virtual Private Network (VPN) encapsulates and encrypts traffic between endpoints, creating a secure logical tunnel over an untrusted network such as the internet. Site-to-site VPNs permanently link entire networks (branch offices to headquarters) using routers or firewalls at each end, while remote-access VPNs let individual clients authenticate and connect on demand via a software client. The key exam nuance is full-tunnel versus split-tunnel: full-tunnel routes all client traffic through the gateway, maximizing security; split-tunnel sends only corporate-bound traffic through the tunnel and allows direct internet access for the rest — faster but riskier, since that traffic bypasses corporate controls.
A protocol suite that secures IP traffic with authentication and encryption, commonly used in VPNs.
IPsec is a network-layer (Layer 3) protocol suite that authenticates and encrypts IP packets, forming the foundation of most VPN implementations. It relies on two sub-protocols: Authentication Header (AH) handles integrity and origin authentication but provides no encryption, while Encapsulating Security Payload (ESP) delivers integrity plus confidentiality. Because ESP adds encryption and works through NAT where AH typically breaks, ESP alone is used in virtually all real-world deployments.
Tunnel mode wraps the entire original packet inside a new IP packet, concealing internal addressing — the standard choice for gateway-to-gateway VPNs. Transport mode encrypts only the payload while leaving the original IP header exposed, suited to direct host-to-host sessions. On the exam, watch for questions that conflate these modes or that credit AH with providing encryption, which it does not.
A security model that trusts no user or device by default and verifies every access request.
Zero trust is a security architecture built on the principle that no user, device, or network segment is inherently trusted — every access request must be authenticated, authorized, and continuously validated regardless of whether it originates inside or outside the corporate network. This contrasts sharply with the older perimeter model, which trusted traffic once it cleared the firewall. Zero trust relies on identity-aware access controls, micro-segmentation, and least-privilege enforcement to contain breaches. On the Network+ exam, watch the distinction from traditional NAC: NAC enforces policy at connection time, while zero trust applies continuous verification throughout a session — a device that passes NAC can still be denied resources if its posture later changes.